Numbers & Oddities; the early days: February 1995-June 1997. 


Additional related info was taken from my ‘Digital Review' column that 
also appeared in the WUN newsletter. 


‘Numbers & Oddities' was one of the columns that appeared in 
the first 9 WUN newsletters. The column was later renamed in 
‘Utility Round-up' when it merged with two other columns. The 
column resurfaced in April 1998. 


Especially interesting are the articles about the various Russian links 
with western intelligence networks, the Russian intelligence/diplomatic 
network and the articles about USAF's EAM's and Skyking messages. 


These early N&O's are renumbered as N&O 079-088. 


N&O #079: originally published as #01 in February 1995 

N&O #080: originally published as #02 in March 1995 

N&O #081: Special edition of N&O (issue #03) and the Digital Review 
column. Originally published in March 1995 

N&O #082: originally published as #04 in April 1995 

N&O #083: originally published as #05 in May 1995 

N&O #084: originally published as #06 in June 1995 

N&O #085: originally published as #07 in July 1995 

N&O #086: originally published as #08 in August 1995 

N&O #087: originally published as #09 in September 1995 

N&O #088: originally published as #10 in June 1997 
(Numbers special in the Digital Review) 


-0-0-0-0-0-0-0-0-0-0- 
The 'Numbers & Oddities' column a.k.a. 'Spooks Newsletter' comes to you 
courtesy of the Worldwide Utility News club (WUN). This newsletter may 
NOT be utilized, partly or wholly, in any other media format without the 
written permission of the editor (ary@luna.nl). Any breach of this may 
result in action under international copyright legislation. 

To become a WUN member, send e-mail to the WUN listserver at: 
majordomo@qth.net and in the BODY of the message type: "subscribe wun" 
(without the quotation marks). 


Check out the WUN web site at: http://www.wunclub.com 


-0-0-0-0-conet-0-0-0-0- 


Feb 1995 


(=- NUMBERS & ODDITIES - 
editor: Ary Boender 
ary@bitbike.iaf.nl 
2:283/512.24 
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In this column I'd like to deal with the more obscure part of our hobby. 
Numbers stations, strange sounds, beeps, pips and items about intelligence 
organizations is what have in mind for the 'Numbers & Oddities' (N&O) column. 
It is both a difficult and a fascinating part of the hobby. There is little 
known of the stations I just mentioned and the main part of the information 
here comes from a bunch of dedicated N&O monitors. It is the result of many, 
many hours of listening, comparing and discussing the loggings with fellow 
dxers. 

Useful information can be found in Popular Communications, Monitoring 
Times, the Enigma Newsletter and of course DX-Club bulletins. The following 
books are also highly recommended: Underground Frequency Guide (Don Schimmel), 
Secret Signals (Simon Mason), Uno, Dos, Cuatro (Havana Moon) and Intercepting 
Numbers Stations (Langley Pierce). 

The most heard numbers stations are operated by the CIA, Mossad, KGB, MI6 
and BND. 

In many countries it is prohibited to listen to utility stations, 
particularly to government or military stations. Therefore I will omit the 
names of the people who send me their info, unless you want to be mentioned. 


Lincolnshire Poacher 


Believed to be operated by MI6 from sites including RAF Akrotiri in Cyprus 
and aimed towards the Near East. Transmissions are often heavily jammed. 
Frequencies (kHz) 


Primary Secondary Tertairy 

6959 8302 7887 2000UTC - QOQOQOUTC 
6959 8464 9251 2000UTC - QOOQOUTC 
11545 12603 13375 16Q00UTC - 2000UTC 
13375 11545 14487 12Q00UTC - 1400UTC 
14487 15682 16084 14Q0UTC - 1600UTC 


MOSSAD "Phonetic Alphabet" Stations 


Transmissions are in AM but with best results obtained in USB. 
Frequency Callsign 
(kHz) 


2957 
3150 
3270 
3417 
3840 
4270 
4360 
4463 
4560 
4665 
4780 
4880 
5091 
5230 
5339 
5437 
5531 
5629 
5715 
5820 
5911 
6270 
6500 
6745 
6840 
6912 
7323 
7446 
7540 
7605 
7613 
7760 
7918 
8127 
8465 
8641 
9130 
9402 
10125 
10648 
10820 
11565 
12747 
12950 
13533 
13921 
14750 
17410 


SYN 

PCD, ART 

KPA 

ART 

YHF 

PCD 

CIO 

FTJ 

YHF 

VLB 

KPA, ULX 

ULX 

JSR 

MIW, SYN, VLB, CIO 
OEM (occasional) 
ART 

BAY (occasional) 
SYN, CIO 

ZWL (occasional) 
YHF 

OEM (occasional) 
ULX 

PCD 

CIO, VLB 

JSR, EZI 

OEM (occasional) 
??? 

KPA 

JSR 

VLB, SYN, CIO 
GPO (occasional) 
ULX 

YHF 

CIO, MIW 

SYN, CIO 

MIW 

EZI 

YHF 

CIO 

YHF 

VLB 

EZI 

SYN 

MIW 

EZI 

CIO 

CIO, MIW 

EZI 


19715 EZI 
20740 SYN 


Oddities: lots of strange noises, pips and beeps can be heard throughout 
the shortwave spectrum. Many of them are simply hets, natural noises or 
originate from navigational systems like Omega, Loran and Decca. 

Other transmissions however, are more difficult to pin-point. Why would 
someone transmit the time in CW without any form of identification, or 
what about the stations who transmit the pips and beeps ? 


On 4625 kHz a buzzer can be heard 24 hours a day. This one started in the 
early eighties as a 2-second pip and changed a couple of years ago into 
the buzzer. The station is located in Byelorussia according to a DF-expert. 
No-one knows its purpose. 


On 4081,3 kHz there is a beep with a duration of 2 seconds which is 
transmitted every 4 seconds. No id has ever been heard. Another one can 
be found on 3757,1 kHz. A pip is transmitted every second. No id so far. 


Also on 4625 kHz is a strange kinda timesignal station. It is best heard 
in the late evenings here in Europe and transmits the time (UTC+3 hours) 
in CW. No id heard. The time UTC+3 is Moscow time. It is unknown if the 
station transmits from the former USSR. The Middle East is also a possible 
location. 


End of message Ende Ende Final Final 
‘till next time. Please, send me your comments, suggestions and loggings. 


CU, Ary 


March 1995 
Additional info: April 1998 


(=- NUMBERS & ODDITIES -=) 
editor: Ary Boender 
ary@bitbike.iaf.nl 
2:283/512.24 


A couple of years ago the 'slhfb' or ‘Single Letter High Frequency Beacons' 
could be heard on numerous frequencies throughout the SW spectrum. After 
the disintegration of the Soviet Union, many of them disappeared and only 


a few survived. Some of them are very active, especially station 'P'. For 
many years the stations have been listed by the ‘experts' as 'beacons'. I 
however, am absolutely convinced that these beacons are in fact channel- 
markers for Russian naval stations. In the past dxers have noted Soviet 
naval callsigns on the 'beacon' freqs. 


The first time I hade a close encounter with the ‘real’ station was in 
December 1990, when I noticed the first RTTY broadcasts on 3807 // 4043 
kHz. It started with the 'P' marker, followed by 75bd RTTY, then back to 
the marker and into 50bd RTTY and back to the marker again. I monitored 
the frequency for another hour or so and after ca half an hour 'P' stopped 
and 75bd RTTY began again. The messages were all 5L groups sent in normal 
Baudot. No other callsign was used, just the letter 'P'. Then on 22-1-1995, 
I finally had a positive id of channelmarker 'P'. On 3262 kHz at exactly 
21.00 UTC channelmarker 'P' started it's transmission: 3 groups of 5 P's 
followed by 'RMP' (= Navy Kaliningrad), then into the weather forecast 

for the Baltic area in plain text. All in CW. Then all went silent. 


Apart from station P, also L, S, R, C and V are frequently heard. The 
home of the markers are ports where also Russian naval bases are located. 
L is located in St Petersburg, S is in Arkhangelsk, C in Moscow, R and V 
are yet unknown. The now defunct markers 'U' and 'K' were respectively in 
Odessa and in Petropavlovsk. 


The odd thing is that I never heard any RTTY on other 'beacon' frequencies, 
while C, R, S and V are there for many years. I also don't know anyone else 
who did hear anything but the markers. So keep you ears open and let me know 
what you hear. 


Frequencies: 

Channelmarker 'C': 3564, 4302, 5306, 7039, 8459, 10612, 13636, 17016 kHz 
Channelmarker 'L': 3090, 26170 kHz 

Channelmarker 'P': 3167, 3208, 3262, 3264, 3290, 3807, 4043 kHz 
Channelmarker 'R': 3195, 4326, 7452, 25250 kHz 

Channelmarker 'S': 4301, 8485, 10872, 17015.7 kHz 

Channelmarker 'V': 3658, 4446, 4576 kHz 


As said 'P' is the most active station, also in digital modes: 


3208,00 "BEACON" Kaliningrad 'P' CW 23,07 15.02.95 at 23:12 UTC 
into high speed CW, marker silent then into RTTY (see below) 
after RTTY cast, the marker was back again. 

3208,00 UNID RTTY-System RTTY 23,15 15.02.95 
Synchronization sequence at the beginning, then 50 Baud PSEUDO# 
bitstream (POL-ARQ synchronization possible, but this is only a 
coincidence) 

3807,00 UNID RTTY-system RTTY 22,15 15.02.95 


Same system as on 3208 ! First bits inverted. During the RTTY cast, 
the marker was not heard, immediately after RTTY ceased, the marker 
was back as usual. 


The 'Russian Man 
The 'Russian Man' numbers stations transmits every morning at 08.00 UTC on 
14890 and at 08.20 UTC on 11270 kHz. The format used is as follows: 

'615 615 615 40577 40577' repeated for 10 minutes, followed by the next 
message. When they are finished a 'Q0000' message is sent. 


On 26-2 at 08.00 UTC, the Russian Man was very busy. I wonder who and where 
'615' is. This is what I caught: no activity on 11270, only a carrier for a 
couple of minutes, all messages were on 14890 kHz. It was also the first time 
that a digital mode was heard. 


08.00: 615 40577 

08.05: pause 

08.10: 615 11111 40237 

08.20: 615 40737 

08.30: 615 42967 

08.40: pause 

08.50: 615 11111 42607 

09.02: into a digital mode for ca 30 secs 


09.02: pause 
09.10: 615 11111 42377 
09.20: pause 
09.30: 615 11111 43207 
09.40: pause 


09.45: 615 11111 00000 


Mossad 
I received a couple of loggings accompanied with the question about the 
different callsigns. 


4665.00kHz 0417h 23 Feb 95 AM 33333 English Numbers 
Calling VLB2. Same voice as EE#. Tx continued past 0430 
without follow-up "message," just continued call. 


The term 'different callsigns' is not exactly correct. The transmissions 
begin with a network identifier and sometimes a numerical code to indicate 
the status of the message. Just 'VLB' would mean that messages will follow. 
VLB1 means ‘there is no traffic but a new schedule is being activated', 
while VLB2 means ‘there is no traffic for you, watch the next schedule’. 


The CIA is a well know numbers provider. Here's the sked: 


REMINGTON NUMBERS SCHEDULE 


times are in UTC , frequencies in KHz 


"TYPE" is in the format "XXY" - "XX" ="SS"(SPANISH), "EE" (ENGLISH) 
"CW" (MORSE CODE), "Y" = (4# DIGITS), "x" = (EVERY DAY), "“d#"= CEASED 
TIME FREQ.S DAYS TYPE TIME FREQ.S DAYS TYPE 
0000 9074/11532 TWThF SS4 1300 #5090/6840 SuWSa SS4 
5090/6840 TTh CW5 10570/13808 W SS4 
8418/11532 Sa Ss4 
0100 6802/9074 T Ss4 
9074/11532 WThSu Ss4 1400 9074/11532 TF Ss4 
9222/11532 F Ss4 8418/10665 Sa SS4 
6802/9074/ 5090/6840 WTh EE 
11532 Sa SS4 14750/15810 T Ss4 
0200 4670/5812 MSa Ss4 1600 8418/10665 Su Ss4 
6802/9074 TTh Ss4 11532/16450 WTh Ss4 
5812/8418 F Ss4 13808/14750 Th EE 
5090/6840 Th EE3/2 
1700 15651/16450 MF Ss4 
0230 6840/9958 * SS4 11532/16450 WTh Ss4 
0300 4307/4670 MTh Ss4 1730 9958/18737 x Cw4 
9074/11532 TWSu SS4 
1800 10665/13452 MTh Ss4 
0330 6840/11605 x Cw4 11532/16450 F Ss4 
7836/9958/ 
0400 8418/11532 M SS4 13808 Sa Cw4 
6802/9222 TF Ss4 
9222/11532  W Ss4 1900 9222/11532 T EE 
9074/11532 = Th Ss4 15810/17693 Sa Ss4 
5812/6802 Su Ss4 
2000 4670/6802 SuT Ss4 
0500 8418/11532 M Ss4 11532/16450 M Ss4 
6802/8418 WSa Ss4 11491/16310 TThSa Sssd4 
5812/6802 F Ss4 10665/11532 F Ss4 
4#5090/6840 * Ss4 
0600 4670/6802 MW Ss4 
48412/9074 Th Ss4 2100 11532/16450 W Ss4 
5812/6802 ThF SS4 18621/16450 W Ss4 
4#5090/6840 * Ss4 
2200 15651/16450 T Ss4 
0700 5812/6802 T Ss4 9074/14421 wW SsS4 
11532/13452 Th Ss4 
1000 5238/6802 M Ss4 4#5090/6840 * Ss4 
5812/6802 T Ss4 
5238/6802 Th Ss4 2300 9074/11532 TTh Ss4 


15651/16450  F Ss4 


1030 7725/10324 x Ss4 
1100 11532/14421 Su Ss4 
5238/5812 MTh Ss4 
9074/13452 =F Ss4 
9074/10665 WwW SsS4 


Richard Brown sent us a book-tip: 

The Sigint Secrets, The Signals Intelligence war, 1900 to Today 
author: Nigel West 

publisher: William Morrow & Co Inc, New York 

ISBN 0-699-07652-1 

'' Tt's a history (partial) of the British signals intelligence efforts 
from the beginning of radio to approx 1986. 
For an example, the British government, at one time, required ALL cable 
companies to deliver copies of ALL telegrams to them within a period of 
10 days of transmission (information suppressed until Feb 1967 (pg 112)'' 


New numbers station 

There is a new numbers station on at 19.00 UTC, Mondays on 6645 kHz AM. The 
station starts with 3 minutes of Jean-Michel Jarre music, then into 17 5F 
groups. Then "again, again" and 17 groups repeated, ending with a minute 
or so of the music. YL's pronunciation is odd with 2=Du and definite roll 
of the "R"s. The message coding is very peculiar, only certain few numbers 
in a few of the 17 groups seem to change each week. 


As J.M. Jarre is a French musician and '2' in French is 'deux' -very much like 
‘'du'- I wonder... could this be a French station ? 


Numbers Club 

I mentioned the Enigma numbers club in WUN #1. For those who are interested 
in the European Numbers Information Gathering and Monitoring Association, you 
may write for more info to B.R.C., 31 Manor Row, Bradford, West Yorkshire, 
BD1 4PS, United Kingdom, or write to e-mail address mikec@praxis.co.uk 


A new riddle within a mystery, wrapped in an enigma :-) 

There's an unid station on 7639.5, 13967.2 and 20.996.2 kHz who transmits 

a message every 10 minutes. The transmissions are in Sitor-B (FEC). The odd 
thing about this station is the kind of messages it broadcasts. They consist 
of two lines. The first line is always a series of 3 even numbers followed 


by the time MINUS 8 MINUTES. The time is given in UTC. The second line of 
each message is always as follows: 2 dashes, 2 vertical dashes, 5Z 5Z TR TR 
and again 2 dashes. 


I captured the following transmissions. These are the first lines: 


15.48 UTC: ''20 20 20 16 16 16 30 30 30 15H40M58S'' 
15.58 UTC: ''12 12 12 30 30 30 12 12 12 15H50M59S'' 
16.08 UTC: ''30 30 30 10 10 10 30 30 30 16HOOM58S'' 
16.18 UTC: unreadable 
16.28 UTC: ''18 18 18 24 24 24 26 26 26 16H20M59S'' 
16.38 UTC: unreadable 


16.48 UTC: '' 8 8 8 14 14 14 22 22 22 16H40M58S'' 
16.58 UTC: ''12 12 12 30 30 30 24 24 24 16H50M59S'' 
17.08 UTC: '' 4 4 4 4 4 4 30 30 30 17HOOM59S'' 
17.18 UTC: '' 0 0 0 6 6 6 30 30 30 17H1OQM58S'' 
The second line of each message: '' --ii 5Z 5Z TR TR -- ay 


So far no id has been noted. 


Additional info from my ‘Digital Review' column, April 1998: 


Timestamp station 


The mysterious timestamp station is around for several years now. The 
station transmits from a spot approximately 60 km NE of Paris. According 
to a usually reliable source, they are a series of observatories that 
are fed correctional (geophysical??) data from the transmitter site, 
which, too is an observatory just outside Paris. It sends a summary once 
a day, too. There are a number of freqs in use, though not usually any 
more than 3 per 18-hour period - probably for coverage redundancy and 
reliability in changing propagation conditions. 


o Frequencies: 5112.2 5127.2 5725.2 7639.2 7762.2 
11482.2 13967.2 15741.5 19013.5 20962.5 20966.2 


o Modes: Sitor-A, Sitor-B 


o Format and operational notes 

The station is supposed to be on the air for 18 hours a day, but during 
a three weeks listening session the off air period varied from 2 to 6 
hours. 


Every 10 minutes a string of figures followed by the time being UTC or 
UTC+1 is transmitted in Sitor-B. This is the weird part of the story. 
Why would a French station stick to British time (UTC = British winter- 


time and UTC+1 = summertime), unless the data that is being transmitted 
is destined to British users.... It certainly looks that way because the 
language used is English. The freqs are duplex freqs but I haven't found 
any QSX freq. Communications with the other stations are in Sitor-A and 
the messages are encrypted except for the callsigns and a few words in 
plain English. After each line of on-line encrypted stuff follows +? 

The other stations apparently have to react. The second line of the 
Sitor-B ‘time stamp' messages changes after each Sitor-A message. 


[Note that the actual time difference was in the past UTC(+1) + 8 mins, 
but they changed it now to UTC(+1).] 


Example: 
-26 -26 -26 -30 -30 -30 -24 -24 -24 - 19h30m54s 
Aik In. ne gh. Age)! ORs 


There are three parameters in the first line, each one is repeated three 
times, followed by the time stamp. The parameters are always even 
numbers, both negative and positive in the range of 2-30. 


The character groups in the second line follow a specific pattern. As I 
said, the pattern changes after each Sitor-A message. During a listening 
period of three weeks late last year, I noted the following pattern: 


-- JN JN -- 

-- JN JN JN JN -- 

-- JN JN 7J 7J -- 

-- JN JN JN JN 7J 7J -- 
se 97 7d? = 


-- JN JN -- 


When the Sitor-A transmissions take place, the next Sitor-B transmission 
is often skipped. Sometimes, if they finish their conversation in time, 
the transmitter stays on and they change from Sitor-A to B and go on 
with the normal routine. 


It seems that other stations are replying because I noted Sitor-A to 
PAVI119 and others consisting of encrypted one-line messages followed 
by +? after which (I think) the other stations are replying. Often also 
AAA+?, NNN+? and OK+? is transmitted. 


Station id's or callsigns(?) noted so far are: 
PAVI 118, PAVI 119, PAVI 120, PAVI 121, VIPA 230, and VIPA 231. 


o Examples 


Sitor-B transmission 


-26 -26 -26 -30 -30 -30 -24 -24 -24 - 19h30m54s 
-- jn jn jnjn 7j 7j -- 


-16 -16 -16 12 12 12 -26 -26 -26 - 19h40m54s 
-- jn jn jnjn 7j 7j = 


Sitor-A transmission 


ok+? 
3 
pavii18 
pavii119 
vipa230 
@ 
+? 
f£txisqjmhdmebnkebsjdpftxisqjmhdndbrnjfengjbsrpjuxaaflj 
+? 
qjmhdmebnkebsjdpftxisqjmhdndbrnjfengjbsrpjuxaaflj 
+? 
tlmunpcojsdbfvdojtdxhymnghgfgwovlnjlmhpmoviwxrmdjaoa 
+? 
qznaxgrhylmfolqvtgwsfvqzllxvtzlaipimycgbovriknbwcppo 
+? 
suekutyzwarhhuvnhoeofhcicvcauudbycpwedorghdxmabdnomn 
+? 
lbhoyahhmgyncfzclqpknrlemixmvjcvukyobtmhhtvhiwdglghe 
+? 
fpyrdfqlmyqpctgrslpbyfenlhtkjjmzeiehxgvsukiipyujlbjh 
+? 
jatnashkkbresmggwkephndxazchahnjqvezpsoufnmwrsckiiaft 
+? 
sgasqpkegoekmfgiokivemqvmyenhsqqohlqbsxaibfrbfbtcnpgj 
+? 
ohdaupjkljmvbkm£hblmczjsbxwhshvrvqwqcejukdgenjnmpb 
+? 
acpltuitaidxacpgznpvgkzobzdsbbaahkcfqsgypcrqkfpyeipm 
+? 

<clip clip clip> 
+? 
wlvvozgaxkovlbkatrxeomki 
+? 
nnn+? 


....and back to Sitor-B again. Note the change in the second line 


-28 -28 -30 -30 -30 30 30 30 - O9h00m54s 
-- jn jn jn jn _ 


-24 -24 -30 -30 -30 30 30 30 - 09h10m54s 
-- jn jn jn jn = 


Another example. Sitor-B into Sitor-A. Note the addresses pavil20, 
pavil21, then ‘pavi1l20 deleted'. The second line changes again after 
the Sitor-A message. 


-30 -30 -30 30 30 30 -16 -16 -16 - 18h00m54s 
-- jn jn jn jn _ 


+? 

2 

pavii120 

pavil21 

@ 

+? 

pavii20 deleted +? 
ftxjapdcspwxmtlhspkezftxjapdcspysdhftszzqbdjdghvdbcdsd 
+? 
xjapdcspwxmtlhspkezftxjapdcspysdhftszzqbdjdghvdbcdgd 


s 

Ac he SaB ABI ni cna aes te saLae be aa RA 
o 

se ANESACIIEL EMCO 
? 

5 aay cauUe Re P ace ea ee ones 
? 

etelie sa aan Spee ates anGek aan UR 
? 

He eer eer eT ee eer ee ene 
ee re en ane ee eT nee 
5 

7 <clip clip clip> 

-26 -26 -26 -20 -20 -20 -2 -2 -2 - 18h50m54s 

-- 74 7] oe 


Numbers & Oddities; the early days: February 1995-September 1995. 


This is the WUN newsletter from March 1995, which was a N&O special. 
This special handles the Russian intelligence and diplo network that we 


first called ‘the Brotherhood' and later 'SOUD', and which is now better 
known as 'FAPSI'. Many updates followed, the most relevant updates can 
be found at the end of this article. A fully updated version of the 
FAPSI monitoring results was published in the WUN newsletter #9706. 
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Monitoring the ‘Brotherhood ' 
by Ary Boender 


Internet: ary@bitbike.iaf.nl 
Fidonet: 2:283/512.24 
Copyright 1995 A.Boender 


Hello WUNners, in this extra edition of the WUN Newsletter, I'd like to 
introduce you to the 'Brotherhood', a Russian related diplo network that 
fits in both the ‘Digital Review' and ‘Numbers & Oddities’ columns. 


Chapter 1: The story so far (1979 - 1995) 

Chapter 2: Examples of chatter, preambles and messages 
Chapter 3: List of link-id's and Callsigns 

Chapter 4: Frequency lists 


(=- a huge THANK YOU goes to my fellow Brotherhood-monitors -=) 
(-= Leif Dehio, Dave Batcho, Paul Scalzo and Don Schimmel -=) 
(-= and to those who sent logs, comments & suggestions -=) 
(=- Thanks for the input and your time guys -=) 


>>>>>>>>>>>>>>>>>>>>> Chapter 1: The story so far <<<<<<<<<<<<K<K<K<cccc<<c<c<<<< 


The first encounters in the USA with the 'Brotherhood' stations were in 
the late 70's when they still used high speed CW (ca 32 WPM). Most of the 
early CW stations (PSN, BPA, SPK, WNY, YBU) are still active today. 'ROL' 
however disappeared completely. In the mid 80's the RTTY transmissions 
started. The speed used was 50bd. Messages to YBU were the most common 
ones in those days. Also messages to PSN were monitored. The callup was 
slightly different from the system that is used nowadays: 


VVV PSN PSN PSN 2/245 VVV PSN PSN 2/245 
NW NW 

NR 271 GR 135 

+ 5L or 5F groups 


Then sometime in the mid-1980's they changed to the 5 group preamble they use 
now. But the original link designators were different then. 


Callsign / Link-id 


YBU 07386 
SPK 06446 
PSN 03861 
KAC 00172 
JMS 00484 
GMN 05418 
BPA 06373 
WNY 01428 
KRN 00484 


Traffic has always been the same group of cypher systems including the 
substitution group at the end. 


By the late 1980's they were being reported in most of the UTE publications. 
Don Schimmel reported them in one of the earliest issues of Monitoring Times 
as UNID and Bob Margolis reported them in PoPComm. 


The NDO link has always been a strange one. Not much activity. Only one sked 

a week (on Wednesdays) and even that is not granted. The WFO / MIG link is 

the only known 2-way link in the Americas. Although it still operates some- 
what clandestinely - minimum amt of chatter, etc. The station sending WFO is 
definitley the Cuban end (by propagation and bearings). The other end has been 
pin pointed in the New York City area, probably the Russian UN delegacy. 


In the late 80's an European network of RTTY stations popped up, similar 
to a network that was active in the America's. Both networks are still very 
active today. 


The master station in Europe was 'RCF'. Several frequency guides listed RCF 
as Ministry for Foreign Affairs in Moscow. After the disintegration of the 
USSR, the 'RCF' callsign disappeared. The new master station is as powerful 
as RCF was and one thing is for sure: this station is located in or very 
near Moscow as well. The station was DFed various times and every time Moscow 
appeared to be the source of the signal. It is very likely that RCF is still 
alive and kicking, but doesn't use its old callsign anymore. 

Whether the master station or RCF really is / was MFA Moscow will probably 
remain a mystery. There are many other suggestions though varying from a 
shipping network to possible connections with TASS, KGB or GRU. 

I stick to the theory that this is a diplo network. Whenever something hot 
is happening, like the Chechenya actions, the stations of the Brotherhood 
are making overtime, even on Sundays, while there are normally no transmis- 
sions on Sundays. The only station that is often heard on Sundays is BFR, 
which may indicate that it is possibly located in an Islamic country. 


The master station transmits crypted messages (5-letter or 5-figure groups) 
to the other stations. There are fixed schedules for a couple of stations 
while others are reported less frequently. During the time that RCF was still 
in place they didn't need to have fixed skeds, as the traffic list system was 
being used. Now that this system is no longer in use, each link has one or 
two fixed skeds on an assigned frequency pair. This system is probably much 
safer, as the sender knows that the recipient received the message correctly. 
The auto-broadcasts to a.o. KUL, VKX, RAU and RKD are probably just circulars 
or routine traffic sent to the specific networks (transmitted blind and 
therefore repeated throughout the day on a larger number of frequencies). 

It appears that almost all the callsigns that were on RCF's traffic list are 
still there. 


So far we have found the following fixed two-way schedules for Europe: 


- 08:25-08:30 ??? to DKR 
- 08:35 2??? to RJA 


- 08:45 WQL to VNB and vice versa 


- 09:10 22? to UXW 

- 09:25 22? to JUA 

- 10:05-10:10 ??? to CAZ 

- 11:15 KKK to KUA 

- 13:20 22? to DKR 

- 14:30 RGA to BFR and vice versa 
- 14:50 22? to RPO 

- 16:35 22? to UDZ 21 

- 16:50 22? to JUA 


The callups and messages can be divided into two groups: the most common for 
the America's and Europe goes as follows: ''4646464646464646 KUL KUL KUL KUL 
1/226''. Note that 46's are transmitted instead of RY's, then the callsign 
of the recipient and the number of messages / number of 5-letter or 5-figure 
groups in this message. 

The other one is yet only noted in Europe. The transmissions start with a 
selcal of 6-tones (the system is called Mazielka), followed by the callsign 
of the recipient sent in CW, then into RTTY where the preamble is handkeyed 
while the other system has an automated preamble. The Mazielka callup is 
fairly new, it has been reported since mid 1994. 

The Mazielka is a selcal system that is used by the master station to wake 
up a station outside the normal fixed sked. It is only used to catch the 
operators attention, not to start the equipment remotely (just like the 
selcal used in aircraft). The fact that they switch to CW after the Mazielka 
is a sure sign that the operator has to prepare the equipment before they 
can start the transmission. The use of non-error correcting RTTY systems 
makes it practically impossible to establish a link automatically. The 
Mazielka has never been heard during the normal schedule times, so probably 
the Mazielka is used when there are very urgent messages that cannot wait 
‘till the regular schedule time. It seems that there are specific channels 
for rush traffic as well. 


I think that a couple of the callsigns are not in use by only one station, 
but that KUL, VKX, RAU and RKD are in fact the callsigns of networks. This 
could mean that the automated transmissions to KUL etc include messages for 
all stations in such a network. This does not necessarily mean that there is 
only one callsign for every station in a network. As far as we know every 
station has a callsign of its own. However, the master station seems to use 
more than one callsign. VNB, KKK and RGA, which are believed to be trans- 
mitting from the same location are most probably callsigns of the master 
station. It seems that the master receives a different callsign on each 
specific two-way link. 


What did we find so far ? 


We have found several clues about the preambles and QSL system. Let's take 


a closer look at the preambles. Each message starts with a preamble con- 
sisting of 5 groups, followed by the message itself. A typical preamble 
looks like this: 11177 00142 23687 05012 01109. 


1st group: probably a message identifier, stating what kinda message it is, 
maybe also a priority code. 11144, 11166, 11177 and 11199 are the 
combinations heard so far. The most common are 11177 and 11199. 
The latter is being used for QSL purposes. 


2nd group: the link-identifier, each link has its own id, except for stations 
who have a two-way link, in that case both stations have the same 
link-id. 


3rd group: the crypto-factor. 


4th group: the first two digits are the date and the last three are the 
message number. 


5th group: the first four digits represent the number of groups in the 
message + 1. The extra group is most likely the crypto-factor 
(3rd group of the preamble). The last digit is either a '1' 
ora '9'. 


After the messages have been sent, the operators sometimes have a little chat. 
In the America's the conversations are in often poor English while on the 
European side often cyrillic is used and also German words are used. 


As I mentioned earlier, there are also QSL messages. The original messages 
can be transmitted on other frequencies and even on other days then the day 
the QSL messages gets out. The first group of the preamble is always 11199. 
The messages always seem to start with 55555 followed by 77011, while the 
last groups represent the QSLed messages. A typical QSL preamble and 
message looks like this: 


11199 00142 00000 18010 00069 
55555 77011 00089 00090 00091 


Five different cipher systems have been noted: 


1) The 3rd group of the preamble is 00000 and the message consists of 5L 
groups. 

2) The 3rd group of the preamble consists of random digits and the message 
consists of 5L groups. 

3) The 3rd group of the peramble consists of random digits and the message 
consists of 5F groups and the last group is NOT 11111. 

4) The 3rd group of the preamble is 00000 and the message consists of 5F 
groups and the last group is 11111. 

5) The 3rd group of the preamble is 00000 and the message consists of 5F 


groups and the last group is NOT 11111. 


The Brotherhood uses various RTTY modes, the most common is Baudot 75bd. 
Sometimes 50 or 100bd is used. They also use a Russian version of Piccolo, 
better know as Crowd36 or CIS Piccolo, Other, yet unknown, exotic modes are 
used as well. Then there is ofcourse the Mazielka and CW is used as well, 
mostly for chatting and callups. 


Who are the partners in this Brotherhood ? Well, it's all guesses ofcourse. 
No-one steps forward and says ‘he you guys, it's me you're looking for' :-) 
According to DF-research, the European master station must be located in 
the Moscow region, while the WFO / MIG link is a link between Cuba and 

the New York area, probably the Russian UN legation. Station GMN could be 
located in Mexico City. 


In ‘Soviet Signals Intelligence’ by professor Desmond Ball, he listed Soviet 
Sigint Posts located in the Western Hemisphere. The sigint posts are in 
Mexico City, Washington 2x, New York City, San Francisco, Managua, San Jose, 
Buenos Aires, Montreal, Ottawa, Chicago and Lima. 

So far, 13 transmission schedules have been noted for the Brotherhood in the 
America's. There are 12 listed sigint posts and 13 schedules, so if there is 
a connection between the schedules and the sigint posts, then there must be 
at least one more sigint post. 

The European scene is a bit different; we have not yet determined where the 
out-stations are located. Most probably outside Russia and in the eastern 
part of the country. 


Then there are the QSF messages: 1/1, 2/1, 3/1, 7/1, 8/1, 9/1 QSF3 

The official meaning of the QSF-code is ''I have effected rescue and am 
proceeding to base''. We can safely assume that the Brotherhood-QSF's have 
nothing to do with the official meaning of the code. Intensive monitoring of 
the stations revealed that QSF2 means a normal schedule, QSF4 means no 
schedule and QSF3 is yet unknown but could mean that an alternative schedule 
will be used. On the days that QSF1 had been indicated a QRU was sent. 


There is a very significant feature to the 5-letter traffic. The last group of 
every message is a simple substitution which indicates the date the message was 
composed and the group count which is always 3 less than the group count shown 
in the preamble. The substitution is: 


0 I U Z T R E W A P 
0 1 2 3 4 5 6 7 8 9 


For example: 
11177 00148 57477 26811 00609 


QKANG XOBJZ ..........-..--22008- VEVXX UEORW 


The last group translates to 26057 -- 26th of the month, 57 groups. 


ETFNJX TKAGAS 

On the American network the sequence 'ETFNJX TKAGAS' is frequently heard. 
It is always transmitted in sloppy FSK Morse for a couple of minutes and 
then the transmission stops or continues in RTTY. Because the sloppy way 
in which this message is keyed, it most probably should read 'E/NJX TKAGAS' 
but also E/NIJX QAG AS is possible. 

The station simply comes up without any callsign and begins broadcasting 
ETNJX TKAGAS over and over for a period of ca 10 minutes. On most occasions, 
approximately 30 minutes later, one of the regular stations comes up and 
sends normal traffic but out of the fixed schedule for that station. The 
'ET' messages have never been observed on the regular daily scheduled 
frequencies. They are transmitted on the same frequencies as the QWk 
messages that are also on the air for the last 15 years. The QWK messages 
are are sent several times a year on one of the regular schedules along 
with the regular traffic. For example, on Dec. 3, 1994, the following was 
at the beginning of BPA's regular schedule: 


QWK QDG FM 5/12 TO NEXT QWK 
FM 00.00 TO 13.00 QSW 10698/7684/13532 
FM 13.00 TO 24.00 OQSW 16224/13532/19612 


Also on Dec. 3, 1995 the following was sent at the end of SPK's regular 
traffic: 


QWK QDG FM 5/12 TO NEXT QWK 
FM 00.00 TO 12.00 OQSW 10183/7418/13227 
FM 12.00 TO 24.00 QSW 19808/16144/13227 


ET messages have been heard on every one of the daytime frequencies listed 
in the messages above. And these messages on these frequencies are almost 
always copied on a Saturday or a Sunday, but occasionally during the week 
as recently as March 22, 1995. The QWK message then seems to say "During 
the times indicated I will use the following as _standby_ or _alert_ 
frequencies." Until February 1995, there were no reports of such a string 
on the European network. 

Recently a sequence, very much like the American one, was heard and it was 
keyed in the same sloppy way. The sequence was slightly different from the 
American one. This one reads 'E/NJX TKAZAS'. The string was recorded and 
played back for -I guess- a million times by several monitors and fed into 
a couple of decoders. Although it was a tough one to write down, we are 100% 
certain that the string is correctly decoded. 


Bloopers 

A couple of years ago, right at the moment that the WFO callup should 

find place, a numbers tape came up. After a moment it was terminated and 
replaced by the WFO callup tape. On another occasion the WNY callup tape 
was replaced by a PSN tape. After a few repetitions of the '464646 PSN PSN' 
lines, the correct WNY callup tape was transmitted. This proves the theory 
that also the American network has a master station. 


CW powerhouses 

Although it is just an uneducated guess, I believe that the CW powerhouses 
that can be heard on numberous frequencies, belong to the same organisation 
as the RTTY network. These stations transmit 5L or 5F groups and often use 
odd Q-codes. In several occasions a CW station transmitted at the same time 
as a RTTY station and was only a couple of kHz away. The signals were equal 
in strength and they faded at exactly the same moment. 


>>>>>>>>>>>>>>> Chapter 2: Chatter, preambles and messages <<<<<<<<<<<<<<<< 


A typical preamble for a message on link 60069, followed by the message 

which consists of 52 5-letter groups. As you can see the 5th group of the 
preamble states that there are 53 groups in this message. That is because 
the last group of the preamble is actually the first group of the message. 


11177 60069 00000 03118 00531 


cwzky fypxz pldyn nwpmd wvihe rfirgy embqy jecdc xixrws omfrg 
ucxxs aeosi pxdfx jtrru ofrva ltlrt vbyzj khgyn dglts rzykr 
bqhwy csffq iekmd jwytt ziydz bvzxm fjrkh lyrgv bbqcg tbctn 
gdhte ydpfc bzvns xoyvd dpnuv kbosy mzuvt dpyim krmmx fvpdb 
iwoyd dphyt sooct zftsu ggmcm dmjcg bclqx jpytn zfwfg shouq 
ppnnj ozoro 


Another example of a message on link 60069, this time 5-figure groups 
were transmitted. Note the '11111' group at the end. 
11177 60069 00000 22209 01301 


72747 28417 50560 87313 85526 80632 52837 50418 16664 76399 
58123 43603 78923 58766 15986 49421 34805 14025 78515 74440 


10019 97789 56541 79041 11698 86832 14191 66922 89474 81657 
03900 16223 95063 13477 97728 66255 27427 67767 02743 82849 
62606 51086 23986 16123 01422 90158 89227 62126 17243 66305 
59757 46873 80493 88263 19018 04742 82333 33503 09448 02138 
89435 56354 28856 81866 33796 86485 95644 22140 76885 88093 
97982 90453 89866 09536 50411 01278 85726 65630 60100 73744 
54969 37039 63648 58444 09316 69664 02392 17253 17128 70258 
49641 99702 69467 93542 62986 62633 80508 93330 99101 00020 
76346 45897 67603 10154 85533 93742 80072 21270 51988 56724 
43127 29860 05485 71573 97484 90177 47836 03396 22210 41105 


The master station in Moscow sends out messages to KUL, VKX and 
several others at a fixed daily schedule. Note the '46' test slip 
instead of 'RY'. 'KUL' is the callsign of the recipient, there are 
3 messages with a total of 535 5-letter groups. (messages shortened) 


464646464646464646464646464646464646464646464646464646464646 
kul kul kul 3/535 kul kul kul 3/535 kul kul kul 3/535 
464646464646464646464646464646464646464646464646464646464646 
kul kul kul 3/535 kul kul kul 3/535 kul kul kul 3/535 
464646464646464646464646464646464646464646464646464646464646 
kul kul kul 3/535 kul kul kul 3/535 kul kul kul 3/535 


11177 00142 33972 29181 01479 


pofre xhtwl ewpxu garrv peife dfhfb sdstt bewph jxqzn uhlwo 
lukhy mavla bgwmu vvhmo tzptw ssxrx ibsho joznd grdlo nmxy£ 
qspsi exvhm hacfj kqzfc nyldc szdqv tvwpv cnotp ozapg orijf 


11177 00142 17790 29182 01459 

uodkh mtauy ssfnc czanv caecr scyiv yccpi kqqhi qvvub qursm 
uozjzZ arrir zutzn zubfy xjzpg ozydy mxgdk cgsec cerbk jvmzc 
qbozz bgssz yjjky guglv avrae yfypo avjux sxfis nihoi zsgmb 
11177 00142 04039 29183 02439 

enqkz kjoan ryvhn vuacc tvzuz fclci zfmsg pmjkw lgqpv aabag 
wqrml mdwux ptenu dwiya xsezx zeppr fomsx poclz paftk ytmyz 
yydix ujdbb xqpkj flujk hbqov temvj ngfhz wynly onbmh iqdjt 


qru qru_ sk sk 


RAU gets also messages from Moscow on the daily basis. 


4646464646464646464646464646464646464646464646464646464646464 
rau rau rau 1/50 rau rau rau 1/50 rau rau rau 1/50 
4646464646464646464646464646464646464646464646464646464646464 
rau rau rau 1/50 rau rau rau 1/50 rau rau rau 1/50 
4646464646464646464646464646464646464646464646464646464646464 
rau rau rau 1/50 rau rau rau 1/50 rau rau rau 1/50 


11177 00070 00000 02012 00509 


95511 17087 98320 83286 97066 36253 72549 37069 35360 107384 
48040 33879 71438 38539 02451 07605 78635 83245 55568 59601 
55663 91143 62376 59010 04870 71347 93615 52923 73086 69033 
61524 28127 89014 24432 41604 85779 98200 90728 49032 53639 
90008 91002 44796 05048 91058 98563 32569 45745 10160 


qru qru sk sk 


The station that started my interest in this network was RCF. 

I captured its signal for the first time in the early eighties. 
Several frequency lists listed this station as MFA Moscow. 

RCF often transmitted callup lists that are similar to the 
traffic lists that many of you may know from coastal stations. 
Note the significant difference between the callups in the above 
listed examples and the RCF broadcasts below. RCF started their 
messages with DE RCF, while the master station now only uses the 
callsign of the recipient, not their own callsign ! 


464646464646464646464646464646464646464646464646464646464646 
cq cq cq de rcf cq cq cq de rcf 

for udz21 caz rpo fru bla rkg rkm bxl uro nr 05 

for acd trp rcex81 wnk nr 06 

qoo nr 05 gr 189 nr 06 gr 219 
464646464646464646464646464646464646464646464646464646464646 
cq cq cq de rcf cq cq cq de rcf 

for jua rxx fqx udz21 caz rpo fru bla rkg rkm bxl uro nr 05 


for acd trp rcex81 wnk nr 06 
qoo nr 05 gr 189 nr 06 gr 219 


ryryryryryryryryryryryryryryry 
cq cq cq de rcf cq cq cq de rcf 
for jua rxx fqx udz21 caz rpo fru bla rcx81 fjn rkg rkm bxl 


uro bnv ewz42 nr 36 37 all gr 1176 


464646464646464646464646464646464646464646464646464646464646 

cq cq cq de rcf cq cq cq de rcf 

for jua rxx fqx udz21 caz rpo fru bla rcex81 fjn rkg rkm bxl 
uro bnv ewz42 nr 36 37 all gr 1176 

464646464646464646464646464646464646464646464646464646464646 


464646464646444646464646464646464646464646464646464646464646 
cq cq cq de rcf cq cq cq de rcf 

for all nr 69 

for glk owr dpl obx ptf dkr wkl kua rss wql lsg nr 08/70 
for qru 

qoo nr 08/70 gr 292 nr 69 gr 1122 


464646464646464646464646464646464646464646464646464646464646 
cq cq cq de rcf cq cq cq de rcf 

for all nr 69 

for glk owr dpl~bx ptf£ dkr wkl kua rss wql lsg nr 08/70 

for qru 

qoo nr 08/70 gr 292 nr 69 gr 1122 


Broadcasts to VKX can be heard very easily both in Europe and 
also in the USA. 


464646464646464646464646464646464646464646464646464646464646 
vkx vkx vkx 1/476 vkx vkx vkx 1/476 vkx vkx vkx 1/476 
464646464646464646464646464646464646464646464646464646464646 
vkx vkx vkx 1/476 vkx vkx vkx 1/476 vkx vkx vkx 1/476 


11177 00166 72959 31124 04769 


wekhe eykuw ntiut pesko hfkbc tehsv lxfvh cczzk znxjp qmweh 
ealxe tmdfn gackt tgbhp nsguf sfbay arbdr whqad hkpuq zivrl 
vipne gwgio fgcfn aajzc wzjum tcoho brbrs xdpbd pgdts utifg 


qru qru. sk_ sk 


A difference between the European and American networks is the lack of 
chatter on the American side. Here in Europe we have occasional chatter 
between the operators. In the America's this seldom happens. The words 
'TIKAS' and 'SEE' are often used, mostly when the operators have a 
‘technical’ chat. 'TIKAS' probably comes from Ticai or Tikat which means 
‘to tick' in various Slavic languages. So TIKAS probably means 'ticker' 
or 'telex operator / telex / telegram / telex machine' or whatever. The 
use of SEE in "OM AS SEE A UR PER?" indicates this translation as well 


(see below for KUA traffic). In this case it would be used as "OM wait, 
look at your perforator" 


vnxr 05 gr 314 

nx 05 gr 314 

tikas 

for ptf kua -after qky qrz 
zkuuuuuukkkkkkaeex 

tikas 


for ptf kua -after qky qrz 
qru sk qru sk 
-> TIKAS in this sense, probably refers to telegram traffic on hand 
-> for 'PTF' and 'KUA'. 
This was heard on the link 10163 on 16.008 kHz at 09:20 UTC 24/08/94 
h qju k 
ok see 


ok asm 


11177 10163 05870~,2.?kb660kk 004(9 


cfm 

64646464 

VVV 

om Ato ne nrawits qb ? 


asm qsa bd 


063 rpt 
wqxkvk ok not 23 bd ? 
mnqsp ? 
ur op 1? 
ok see hr all cfm pse qsp tikas pbl ili qrz op 1 


ryryryryryryryryry 


om pse sa qsp ? 

gr ? gr ? pbl gr12345? 
pse nryvr mni wrk vy qrl 

ok asm ee see 

pse qsp tikas hr all cfm 


see agn 
05870 pse k 
asm 


hw 
gmagvl qsp vy pse qsp ur k 


op 1 qrl ? 

ok vy om Ato ne tak ? 

ur new op ? 

om pse qsl my qtc tak ok ? 
op 1 all qsp after ili pse qrz after 
ok ? 

hr a wrk op 1 hr all cfm ok ? 
cfm tks qsl 1 k 


The following was heard on the KUA link. Note the last paragraph in 
which the operator asks if he may use a Russian register to continue. 
The RTTY message was sent in 'normal' shift while it is easier for 
the operator to chat in 3rd shift Cyrillic, or what he calls 'Ruskih 
registrow’. 


first CW: ''qsy 14622 qsy 14622 kua kua qsy 14622 ga'' 
then into RTTY 75bd 


RYRYRYRRYRQRYGYRYRYRYKRRYRYRYRYRYRYRYRYRYRY 
RYRYRYRRYRQRYGYRYRYRYKRRYRYRYRYRYRYRYRYRYRY 
OM HR SA AS SEE A UR PER? 

NOT FB 

PSE AGN ES’ SEE POV 

SANX POV NAU4isx lenty prawilxno delatx 
MA&ina ih ne bereit 

GA GA 


RYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYR 
11177 30022 45013 20882 00549 

KDRUG ALMIV LPTAT EACKS YBVPF LSCXG AFJII XDAHJ RQMXY JIXFV 

HAJME EJKMA XMXLE ADMSE DSYHQ ZVAIZ ORANL PEBPI EHPGZ LTYFU 

OSBBX DBWRM EKOOB NOZVX UPPPW ZVXHC OAETV DQJBR ABQFD TCILT 

QSL 4 


QRU 
CFM TKS GB SK 


FXRYRYRYYYRYRYRYRYYRYRYRYRYYRYRYYRYRYRYYRYRYRRYRRYR 
QSP QSP QSP TX QSP X ZLD ZLD 
11177 30022 48526 20886 03859 


MIPYE KVMGG AOCHW RDJLJ FCMOO UORGV CFKYE PVSLM YMOMY CYBUU 
ZYTNE RTPRB QMBUA GKAUP GEMLK HPCVN ZPQYS ODTWT OXUTC UWFWC 
SINUB RYXCV RDJWC VUNLX CMCMW VHUUK ZFHAJ NYZJO GBIST PXQMA 


QRU QSL 4 ALL FM OM PSE DAWWAJ MEDU TXT ES PL PBL 
OKOLO 15 RUSKIH REGISTROW OK ? TQVELO RABOTATX INA 4E OV?? 
TKS GB SK SK 


Here again a message from the master station to VKX. Note the test 
schedule at the end. 


464646464646464646464646464646464646464646464646464646464646 
vkx vkx vkx 1/476 vkx vkx vkx 1/476 vkx vkx vkx 1/476 


11177 00166 72959 31124 04769 5-letter-groups 


fm 12.05 test qrg 12124 
fm 12.05 test qrg 12124 


qru qru sk sk 


Q-codes are frequently used. This is an unusual long chatter including 
a transmission schedule. 


OM  QRU PSE QBN QBNVVVVVVOM PSE QOZz 
RYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYYRYRYRYRYRYRCSYRYRYRYRYRY OK OK 
OK OM HR QRZ WM EM 

QSA QTR ? 464600SA NOT NOT QSA NOT OK OK OK OK 

HR ALL OK PSE AS M OM OM HR SEE QUW ONLI QSW 

14622 M OM HR SEE UR WRK OK 

GP11YWW QSA 0 

OM ALL OK WILL QSPALL OK WILL QSP PSE AS 3 ALL OK OK AS 

SEE S WILL QSP ES SA ALL QRG QUW PSE AS SEE WL 


464646464646464646464646464646464646 
04-06 QRG 13466 11134 80043 15683 
06-14 QRG 18587 18617 17488 21860 
14 -18 QRG 16337 12188 11028 17488 
18-04 QRG 8815 7376 6884 11068 


OM OM PSE LNT ONLI QSY HR UR QRG SA FM KY 1 OK ? AS M 


OM OM AFTER PSE LNT ONLI QSY OK ? HR’ SA UR QRG FM KY 1 AS M M OM OM PSE 
TEST QRZ QSU OM OM HR SEE PSE SEE HR WRK QAZNOT NOT OM OM PSE TEST 
QSR 

OM OM PEREWERN I LNT NA TT  WYZOWOM IDET ZADOM NAPERED OM OM 

BK BK BK BK BK BK BK OM OM ALL FB FB FB OM OM PSE  TESR 

QRZ QSR QRG 14929 OM PSE TES QSR QRG 14929 OK ? HR SEE SEE OM OM 
PSE QSP NOMER KORRESPOND UR WRK NR 21 21 21 646464646464 64640K OK OK 
OM OM HR’ TEST QSR WRK BD OM OM PSE QSP NR KORRESR OM OM HR WRK NR 21 

SINH SINHRON NR 21 

OM OM QRZ QUW WRK FB O OK OK OM OM HR WILL QTC PSE AS SE OM OM PSE 
QOZ HR WILL SA OP 1 OM OM AI TO U TEBQ NE RABOTAET W QSU 
6464646464646464640M OM PSE QBN QBN 646464646464646464646464646464646 
46461IM OM PSE QBN QSA NOT QSA NOOT PSE QBN HMFB FB FB FB’ OM OM SEE HR 
WILLQRZ OK OK OM OM HR WILL QRZ QSU OM UR WILL QRZ QUW LNT OK ? OM OM 
HR QTC NOT QRQ WILL QSO F CFM CFM OM QTC NOT QRQ OM OM QTC W QSO OK QSL 
? QSL ? F CFM CFM TKS GB SK SK PSK URR ALL FB’ GB_ GB SK SK PKS 


The QSF codes: 


The 'RAU' transmission at 14:10 UTC contained the following 
(msg was repeated on 12180 kcs, shortly thereafter): 


46464646464646464646464646464646464646464646464646464646464 
rau rau rau qsf rau rau rau qsf rau rau rau qsf 
12/12 wrk qsf 4 

12/12 wrk qsf 4 

qru qru_ sk sk 


The 'KUL' broadcast on 10584 consisted of the following. Interesting is 
the fact that the 'KUL' transmission on 10584 had one more message than 
the previous transmission on 12193 kHz. Looks like they got one more 
message in, during their transmission. 


646464646464646464646464646464646464646464646464646464646464646 
kul kul kul 2/845 kul kul kul 2/845 kul kul kul 2/845 


12/12 wrk qsf 4 
12/12 wrk qsf 4 


11177 00142 00000 09749 07201 


all qtc 3/1013 
all qtc 3/1013 
12/12 wrk qsf 4 
12/12 wrk qsf 4 


qru qru_ sk sk 


YBU sent this right after his callup and before any other traffic 
was sent: 


QWK QDG FM 1/11 TO NEXT QWkK: 


FM 00.00 TO 04.00 QSY 11212/10135/ 8147 QSW 10243/ 8108/ 5837 
FM 04.00 TO 11.00 QSY 8225/ 7610/ 6308 QSW 6845/ 5877/ 5258 
FM 11.00 TO 14.00 QSY 6645/12530/17325 QSW 5797/11406/16308 
FM 14.00 TO 21.00 QSY 16830/18290/19580 QSW 15682/17490/18839 
FM 21.00 TO 24.00 QSY 18876/14814/11180 QSW 17490/13627/10294 


Then he sent "AGN AGN" and repeated it. Later that same day, station WNY 
(on high-speed CW - 34 WPM) sent this: 


VVV VVV WNY WNY WNY 
NW NW 


QWK QDG FM 1/11 TO NEXT QWK 

FM 0000 TO 0300 OSW 8144/6881/5745 
FM @300 TO 1200 QSW 8144/6881/9246 
FM 1200 TO 2400 QSW 10131/15559/8158 


RPT AGN RPT AGN 


((repeats entire msg)) 


Traffic sent to ‘JMS' contained this before the regular traffic: 
Febuary 03, 1995 22.30 UTC 16842.5 kHz 


ILC QDG FM 4/2 TO QWK 

FM 00.00 TO 13.00 QWS 10713/8118/13541 

FM 13.00 TO 24.00 QWS 18053/16491/13541 
QWK QDG FM 4/2 TO NEXT QWK 

FM @0.00 TO 13.00 QSW 10713/8118/13541 

FM 13.00 TO 24.00 QSW 18053/16491/13541 


To show you the similarity in traffic on both the European and the North 
American sides, I quote a piece of a transmission from Moscow to -I guess- 
DKR: 


GXWHQ UJBAZ FZLCV WNEGK JZAHF MWZIJ WNEZO QQKLN WKTUS YUSJIZ 


HIOUK JBUPV SKLBI JVTCW KPZJW UTUUT 


OM PSE SEE TIKAS 
HR RPT AGN 


04.00-06.00 

QRG 1 18565/16058/15683/13466/12158/11028/10328/8487 /8178/7537 
QRG 2 14578/11536/11134/8043/7867/7376/6888/5414/5858/5021 
06.00-14.00 

QRG 1 23170/22825/21860/18587 /20071/18234/15683/14578/16337/12158 
QRG 2 18234/18573/18617/17488/18364/13466/11028/10218/8877/7833 
14.00-18.00 

QRG 1 12131/15733/17488/16337/18617 /16184/18308/14486/16058/11614 
QRG 2 7814/10315/12188/11028/12188/11536/12131/8203/8843/5478 
18.00-04.00 

QRG 1 10512/10218/11068/8815/10707/8826/8487 /7608/7885/5858 

QRG 2 6885/6888/7376/6884/6885/6888/5836/5015/5771/4526 


OK ? 

WRK FM 01 11 80 KWK QUW TO NEXT QWK 
ALL OK? 

PSE ALL QSP TIKAS 

NIL 

PSE QSL 

CFM 


QSL messages which always bear a 11199 as the first group in the 
preamble, and begin with 55555. Recently a startling message was 
sent by YBU. It seems to be the first unenciphered code ever seen 
on the Brotherhood. Here is the entire message: 


11199 00148 00000 20269 01759 


55555 77011 99641 99749 99736 99719 99726 99667 99635 99749 
99736 99710 99750 99736 99751 99762 99640 99607 99749 99736 
99748 99749 99736 44326 99736 99612 99721 99736 99705 99736 
99678 99736 99688 99744 99641 99744 99641 99635 99696 99696 
99641 99655 44326 99736 99607 99704 99737 99688 99744 99641 
99744 99750 99750 99696 99641 99768 99655 44326 99736 99704 
99664 99751 99688 99744 99641 99744 99750 99750 99696 99750 
99635 99655 44326 99607 99751 99698 99737 99639 99744 99750 
99721 99688 99721 99641 99750 99744 99750 99641 99636 99744 
99736 99711 99649 99736 99635 99696 99736 99656 99736 99635 
99641 99736 99749 99750 99749 99736 99719 99756 99740 99736 


99687 99736 99612 99721 99736 99705 99736 99678 99749 99677 
99736 99612 99736 99649 99635 99696 99736 99683 99696 99696 
99639 99696 99750 99681 99736 99656 99736 99765 99635 99639 
99765 99721 99681 99655 99736 99612 99736 99649 99635 99641 
99683 99750 99768 99639 99750 99636 99681 99749 99765 99749 
99736 99724 99742 99736 99725 99640 99647 99751 99676 99775 
99747 99601 99747 99749 


Analysis shows that starting at the third group, this message 
uses a trinomial (3-digit) code. When sent as 5F groups, the 
first two digits of each 5F group are nulls. All of the code 
groups begin with either a 6 or a 7 except for the one group 
(repeated three times in the message) which uses 44 as the nulls. 


What do you think of this chatter by NDO's operator: 
"SULTAN BORN DOTHER (3500/54)" good example of bad English; I 


assume the 3500/54 is the weight and length in metric of the new 
born daughter. 


>>>>>>>>>>>>>>>>>> Chapter 3: Link-id's and Callsigns <<<<<<<<<<<<<<<<<<<<<< 


Brotherhood link-id's and callsigns. The '*' marks stations that also 


appeared on the RCF traffic lists. 


Link Callsign Remarks RCF 


EWZ 42 


RCX 81 


7 
Cc 
+t + + + + FF FF HF FF HF HH OF 


00030 
00030 
00052 
00070 
00098 
00099 
00116 
00117 
00119 
00125 
00125 
00126 
00127 
00128 
00135 
00139 
00142 
00148 
00149 
00156 
00162 
00166 
00168 
00177 
00178 
00208 
10042 
10075 
10163 
20054 
20054 


RSS 
RXX 
TRP 
URO 
WKL 
OTD 
SCJ 
CMU 
DMA 
ROO 
RZJ 
RMM 
EWZ 40 
UDZ 27 
UXG 
KDN 
ROL 
BFR 
RGA 
NOX 
RAU 
VTX 
RSZ 
BPA 
HZW 
GMN 
MIG 
WFO 
PSN 
JMS 
KAC 
BAR 
WNY 
KUL 
YBU 
DZR 
NDO 


VKX 
SPK 


KRN 
RKD 


UDZ 21 


(2 way contact with RGA) 
(2 way contact with BFR) 


(2 way contact with WFO) 
(2 way contact with MIG) 


(2 way contact with ???) 
(2 way contact with UDZ 21) 


+t + + + + + + + FF FH HH OF 


30022 KUA (2 way contact with Kkk) x 


30022 KKK (2 way contact with KUA) 

30044 

30088 

40034 UXW (2 way contact with ???) 

40034 (2 way contact with UXWwW) 

50002 CAZ (2 way contact with ???) * 
50022 (2 way contact with CAZ) 

50035 JUA (2 way contact with ???) * 
50035 (2 way contact with JUA) 

50079 

60003 

60047 

60069 

70060 DKR (2 way contact with ???) x 
70060 (2 way contact with DKR) 

80031 

80038 RPO (2 way contact with ???) * 
80038 (2 way contact with RPO) 

80061 VNB (2 way contact with WQL) 

80061 WQL (2 way contact with VNB) * 
90051 RJA (2 way contact with ???) 

90051 (2 way contact with RJA) 


>>>>>>>>>>>>>>>>>>>>>>>> Chapter 4: Frequency lists <<<<<<<<<<<<<<<<<<<<<<< 


Brotherhood frequencies, Europe Last update: 29-3-1995 


* indicates inactive channel 


FREQUENCY Link-ID TIME RTTYMODE 

4873,00 <0Q0142> 18,50 F1B-75 to 'KUL' /after 6798 transm. 
4880,00 <00142> 18,52 F1B-75 to 'KUL'x* 

6798,00 <00142> 19,15 F1B-75 to 'KUL' 

7525,00 <00149> 16,25 F1B-100 '???' to 'DZR' 

7692,00 <?????> 16,35 F1B-75 

8084,00 <00030> 14,47 F1B-75 'BFR' to 'RGA' QSX 10767 
8165,00 <00142> 7,27 F1B-75 to 'KUL' 
10125,00 <?????> 13,50 F1B-75 
10183,00 <00166> 10,36 F1B-75 to 'VKX'x 
10202,00 <?????> 9,25 F1B-75 
10218,00 <50035> 15,57 F1B-75 '???' to 'JUA' ??? 
10244,00 <?????> 14,45 F1B-100 
10260,00 <50035> 16,50 F1B-75 '???' to 'JUA' 


10410,00 <00142> 7,15 F1B-75 to 'KUL' 


10426,00 <?????> 15,06 F1B-75 


10453,00 <70060> 15,12 F1B-75 '???' to 'DKR' 

10482,00 <90051> 18,18 F1B-75 to or from 'RJA' 

10485,00 <80061> 8,45 F1B-75 '‘WQL' to 'VNB' QSX 13425 
10584,00 <00142> 14,19 F1B-75 to 'KUL'/after 12193 transm. 
10586,00 <00142> 14,25 F1B-75 to 'KUL' 

10672,00 <00149> 16,25 F1B-100 '???' to 'DZR' 

10735,00 <90051> 15,30 F1B-75 '???' to 'RJA' 

10744,00 <00052> 9,15 F1B-75 to or from 'NQX' 

10760,00 <10075> 15,05 F1B-75 

10762,00 <0Q0030> 14,48 F1B-200 'RGA' to 'BFR' 

10767,00 <0Q0030> 15,00 F1B-75 'RGA' to 'BFR' QSX 12239 
10915,00 <80038> 15,05 F1B-75 to or from 'RPO' 

11132,00 <0Q0166> 12,00 F1B-75 to 'VKX'x 

11412,00 <60069> 16,09 F1B-75 

11413,00 <60069> 15,36 F1B-75 

11421,00 <00149> 15,27 F1B-100 '???' to 'DZR' 

11433,00 <30022> 15,50 FIB-75 'KKK' to 'KUA' 

11434,00 <10042> 18,25 F1B-75 

11436,00 <00149> 15,40 F1B-100 '???' to 'DZR' 

11440,00 <30022> 11,31 FIB-75 'KUA' to 'KKK' 

11468,00 <00149> 14,26 F1B-100 '???' to 'DZR' 

11477,00 <?????> 14,40 F1B-75 

11487,00 <30044> 14,38 F1B-75 

11507,00 <80038> 15,05 F1B-75 to or from 'RPO' 

11541,00 <50035> 17,13 F1B-75 'JUA' to '???' QSX 10260 kHz 
: backup channel only ! QSY from unknown freq. 
12124,00 <00166> 12,05 F1B-75 to 'VKX'x 

12130,00 <00098> 15,55 FIB-75 '???' to ‘VTX' 

12132,00 <00149> 9,20 F1B-100 '???' to 'DZR' 

12134,00 <0Q0098> 15,35 FIB-75 '???' to ‘VTX' 

12137,00 <00162> 10,10 F1B-75 

12144,00 <20054> 16,37 CW 'UDZ 21' to '???' QSX 14854 
‘ backup channel only ! QSY from unknown freq. 
12146,00 <10042> 11,43 F1B-75 

12151,00 <?????> 15,15 F1B-75 

12152,00 <?????> 17,17 F1B-75 

12152,00 <70060> 9,45 F1B-75 '???' to 'DKR' 

12157,00 <?????> 9,18 F1B-75 '???' to 'RAD' 

. +UNID RTTY-mode F1B-200 PSEUDO#-bitstream 
12174,00 <0Q0052> 13,30 F1B-75 '???' to 'NQX' 

12180,00 <00166> 15,12 F1B-75 to 'VKX' after 14852 transm. 
12180,00 <00070> 14,28 F1B-75 to 'RAU' after 14980 transm. 
12193,00 <0Q0142> 14,15 F1B-75 to 'KUL' 

12194,00 <00052> 9,43 F1B-75 to or from 'NQX' 

12197,00 <00142> 14,12 F1B-75 to 'KUL' 

12223,00 <20054> 17,30 F1B-75 to 'UDZ 21' ??? 


12239,00 <00030> 15,05 F1B-75 'BFR' to 'RGA' QSX 10767 


12332 ,00 
13016 , 00 
13393 , 00 
13400 , 00 
13420 , 00 


13420 , 00 
13425 , 00 
13506 , 00 
13507 , 00 
13520,00 
14427 ,00 
14577 ,00 
14587 , 00 
14605 ,00 
14608 , 00 
14622 ,00 
14622 ,00 
14625 ,00 
14630 ,00 
14632 ,00 
14640 , 00 
14736 ,00 
14820 ,00 
14830, 00 
14832 ,00 
14834 ,00 
14842 , 00 
14852 ,00 
14854,00 
14863 , 00 
14870 ,00 
14894 ,00 
14947 ,00 
14950, 00 
14950, 00 
14971 ,00 
14973 ,00 
14974 ,00 
14977 ,00 
14980 , 00 
14985 , 00 
15678 , 00 
15678 , 00 
15696 ,00 
15696 ,00 
15702 ,00 
15707 ,00 


<10042> 
<00125> 
<60003> 
<00030> 
<00030> 


<80061> 
<40034> 
<40034> 
<40034> 
<80038> 
<80038> 
<00166> 
<00166> 
<00166> 
<30022> 
<00099> 
<30022> 
<00142> 
<00125> 


<00166> 
<20054> 


<00070> 
<00070> 
<00070> 
<00070> 
<00070> 
<00070> 


<00030> 
<00030> 
<60047> 


14,36 
14,17 
15,56 
13,20 
13,15 


12,41 
8,53 
9,10 
9,20 

11,00 

09,27 

14,59 

14,50 

15,01 

15,00 

12,18 

10,56 

14,28 

11,48 

12,30 

15.30 

14,18 

14,20 

15,22 

16,05 

16:10 

13,44 

11,00 

16,35 

11,53 

14,33 

13,44 

10, 07 

14,30 

14.34 

14,10 

14,12 

14,12 

14,12 

14,10 

14,10 

12,44 

11,50 

14,50 

11,50 

10,48 

13,00 


F1B-75 
F1B-75 
F1B-75 
F1B-75 


RTTY on 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-100 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
6-tone 
F1B-75 
F1B-75 
6-tone 
F1B-100 
F1B-75 
F1B-75 
F1B-75 
6-tone 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 


'MIG' to 'WFO' 

QSX 14412 = altern. freq 
"RGA' to 'BFR' QSX 12239 
6-tone/CW 'RGA' to 'BFR'/ 

13400 kHz QSX 12239 kHz 


'VNB' to 'WQL' QSX 10485 
'22??' to 'UXW' 
'22??' to 'UXW' 


to or from 'UXW' 
'222?' to 'RPO' 
'222' to 'RPO' 


to 
to 
to 


'VKX' x 
'VKX' * 
'VKX' x 


"KUA' to 'KKK' QSX 16054 
to or from 'RSZ' 
probably 'KUA' 

"KUA' to 'KKK' QSX 16054 


to 


"KUL 


'MIG' to 'WFO' 


'BFR' to 'RGA' 


to 


to 


"RKD' 


"VKX' 


'2?2??' to 'UDZ 21' 
+ CROWD 36 (14865 kHz) 


to 
to 
to 
to 
to 
to 
to 


"RAU' 
"RAU' 
"RAU' 
"RAU' 
"RAU' 
"RAU' 
'NQX'???°? 


'22??' to 'NQX' 
'RGA' to 'BFR' ???? 
'RGA' to 'BFR' 
'RGA' to 'BFR' 


. /QRM 


15708 , 00 
15710 ,00 
15722 ,00 
15734,00 
15826 , 00 
15826 , 00 
15836 , 00 
16008 , 00 
16018 , 00 
16032 ,00 
16054, 00 
16064 ,00 
16081, 00 
16108 , 00 
16153 , 00 
16154, 00 
16155, 00 
16214 ,00 
16225 ,00 
16232 ,00 
16242 , 00 
16244 ,00 
16252 ,00 
16273 , 00 
16277 ,00 
16285, 00 
16285 , 00 
16324 ,00 
16332 ,00 
16342 ,00 
16344 ,00 
17533 ,00 
18092 ,00 
18225 ,00 
18250, 00 
18332 ,00 
18420 , 00 
18424 ,00 
18440 , 00 
18585 , 00 
18610 , 00 
18752 ,00 
18835 ,00 
20042 ,00 
20340 , 00 
20690 , 00 


<00030> 
<30022> 
<00030> 
<10042> 


<10163> 
<10163> 
<30088> 
<30022> 
<30022> 
<00166> 
<70060> 
<70060> 


<60003> 
<00099> 
<90051> 
<00149> 
<00098> 
<60069> 
<00177> 
<00099> 
<30022> 
<10042> 
<10042> 
<30022> 
<30088> 
<60003> 
<00166> 
<50035> 
<10042> 
<50079> 
<10042> 
<50002> 
<80038> 
<60069> 
<00030> 
<60003> 
<10042> 
<80038> 


15,30 
14,58 
11,05 
13.05 
9,30 
9,45 
12,53 
9,20 
12,33 
9,55 
10,10 
10,53 
9,33 
7,504 
8,30 
8,45 
10,05 
9,54 
16,35 
8,39 
17,00 
8,33 
11,47 
8,15 
11,15 
8,45 
8,40 
11,40 
8,55 
11,28 
11,40 
10,15 
8,42 
11,00 
9,25 
9,14 
11,30 
14,05 
11,40 
10,10 
10,35 
7,31 
14,35 
8,50 
11,10 
11,47 


F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
CW 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
6-tone 
F1B-100 
F1B-75 
F1B-100 
F1B-75 
F1B-200 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 
F1B-75 


'RGA' 
"KKK! 
'RGA' 


to 'BFR' 
to 'KUA' 
to 'BFR' 


to 'UXW' ???? 
to 'UXW' 


arate 


"KKK! 
"KKK! 


to 'RAD' request QSY 11672/13434 


to 'KUA' 
to 'KUA' 


to 'VKX'x 


122?! 
122?! 
sar at ard 
2 oR 


to or 
122?! 


to or 
to or 


to or 
"KKK' 


"KKK! 


to 'DKR'/also 13:20 
to 'DKR' 

to 'DKR' ??°? 

to 'FQX' 


from 'RSZ' 
to 'RJA' 

from 'DZR' 
from 'NXQ' 


from 'RSZ' 
to 'KUA' 


to 'KUA' 


to 'VKX'x* 


122?! 


122?! 
to or 


'RGA' 


to or 


to 'JUA' 


to 'CAZ' 
from 'RPO' 


to 'BFR' 


from 'RPO' 


Brotherhood frequencies, America's 


Last update: 26-3-1995 


Messages are sent on the primary frequency and repeated right 
afterward on the secondary frequency. 


Frequencies 
Primary / secondary 


Link-id 


Mode 


Remarks 


F1B-75 to PSN 
F1B-75 to MIG 
F1B-75 to MIG 
F1B-75 to BPA 
F1B-75 to WFO 


13382.1 
13382.1 


14727 
14736 
14736 
16224 


16228 
16283 
16327 
16327 


16448 
16448 
16843 
17450 
18081 


18081 
18828 
19618 


19618 
19808 
19808 


19957 
20140 
20588 
20733 
20823 
21867 


The 'Numbers & Oddities' 


19957 


00125 
00125 14. 


10424 


13532 
18805 
14236 


14376 
14376 


13627 


16491 


16491 


16138 


16138 


16144 


17480 


16448 


18128 


18128 
18846 


00126 
21.15 


00116 
00125 

00125 

00116 


00148 
00128 
00128 
00128 


00135 
00178 
00127 
00156 
00127 


00127 
00117 
00148 


00148 
00168 
00168 


00126 
00148 
00139 
00119 
00135 
00168 


22 


15 
15 


35 


.15 


14.15 


21 


14. 
20. 
14. 
20. 


13%. 
17. 
22. 
16. 
16. 


22. 
20. 
16. 


19. 
13. 
16. 


22. 
22. 
19. 
16. 
.00 
16. 


21 


.15 
16. 


00 


00 
45 
50 
45 


00 
30 
30 
50 
20 


30 
00 
10 


35 
45 
00 


40 
00 
00 
45 


00 


F1B-75 
F1B-75 


F1B-75 
F1B-75 
F1B-75 
F1B-75 
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Updates to the above article. The original updates were written between 
April 1995 and June 1996. 


The 'Brotherhood' 

Thanks for the many compliments that you sent me for the Brotherhood 
special. I hope that the story made you tune in to these stations. I 
wonder if the Brotherhood also has a network in Australia. Has anyone 

in this part of the world heard stations like this ? Does anyone know 
where the stations in Europe and America's are located ? Please, tune in 
as often as you can and let me know the results. It would be nice if we 
could unwrap this mystery. As promised there will be updates to this 
article in my columns. Here is the first update to the European frequency 
list: Callsign NQX must be NXQ. 


Frequency UTC Link Mode / remarks 

16008 kHz, 9.17, 10163, F1B-75 

12136 kHz, 15:32, 00149, F1B-100 'DZR' to "Master" backup channel 

11460 kHz, 15:32, 00149, F1B-200 !! "Master" to 'DZR' (sked 15.30) 

12174 kHz, 08.00, 00052, F1B-75 to NXQ 

Brotherhood update 

One new link has been noted in April: 

Callsign: RVV, Link-id: 20087, UTC: 14.20, Freq: 13.418 kHz. 

The transmissions to VKX on 14605 kHz are now scheduled for 16.10 UTC. 
'Brotherhood' update 


A new sked for KKK (to KUA) can be found on 10850 kHz at 19.04 UTC. 


In our WUN-special about the Brotherhood, I told you that it most probably 
is a diplo-related network. Just recently some new and very interesting info 


came in. It seems that it is more than just diplo-related. According to 
usually well informed sources, this network belongs to an organization 
called SOUD. 

This organization was founded in 1977 by the Communist block and is 
basically an intelligence agency, accessible by all members of the former 
and still active communist block. The job of this organization is to gather 
information on everyone and everything - including their own and foreign 
embassy personnel. They are said to be based either on the premises of the 
Russian embassies and/or in separate installations. The organization's 
central computer is located in Moscow, and queries from members, regarding 
any subject are said to be handled in less than 4 hours time. 


This theory makes sense, because it would explain: 

- the use of Baudot telegraphy as some of the members don't 
have the money to get hold of sophisticated equipment and 
with so many nations involved it is of course a question of 
standardization! 

- the almost worldwide appearance of this net 

- the question "ruskih registrow ok ?" which is rather puzzling 
if this were to be a solely Russian net (see WUN#3). 

- the use of non Russian words ("bereit", "Si") 


Ok, who are they ? Little is known of the ultra secret intelligence 
organization SOUD "Soglashenije o Sisteme Objedinennowo Utschotja Dannych 
o protiwnike" which is Russian for "System for mutual gathering of info 
about the enemy". This organization was founded in 1977 and was meant to 
serve as an electronic information gathering association between the 
intelligence agencies of the socialist camps. The members of SOUD were the 
Soviet Union, Bulgaria, Hungary, Poland, Czechoslovakia, Mongolia, Cuba and 
ofcourse Eastern Germany. They were later joined by Vietnam. 

The immediate cause for the foundation of SOUD were the 1980 Olympics in 
Moscow. To safe guard the USSR from ‘foreign hostile forces' during the 
Olympics, the main task for SOUD was to gather as much information about 
the ‘enemy' as they possibly could and store this info as comprehensive as 
possible. Because the western countries boycotted the Olympics in Moscow, 
most of the ‘enemies' didn't show up either. Nevertheless SOUD became an 
absolute hit in spy-land. Their success was so huge that they survived the 
end of the cold war and even the collapse of the communist block. 

After the foundation in 1977, it took about 2 years before they became 
active. Besides the initiator, the KGB, no agency was as fanatical as the 
East German Stasi. SOUD still gathers information about all possible 
‘enemies’ of the alliance which are stored in the main computer in Moscow 
and queries from members, regarding any subject are said to be handled in 
less than 4 hours time. 

The SOUD databanks include names of agents, zionists, hostile religious 
organizations and organizations of emigrants, journalists, diplomats, 
cultural and commercial attach s, representatives of airlines, etc etc. 
Information found in Stasi documents reveals that in 1989 more then 11100 


names were collected. Most of them included a personal description, the 
maiden name of the mother and a sample of the handwriting. 


Brotherhood update 

A new sked for messages to RAU can be found on 13880 kHz at 08.10 UTC. 

UXW has a fixed sked at 09.10 UTC on 14426 kHz with RLX in Moscow, the 

other end of the link is on 13506 kHz. The link id for both stations 

is 40034. 

-> The 'Brotherhood'/SOUD stations RLX & UXW were extremely busy during 
the London conference on Bosnia, RLX sent monster messages to UXW for 
over an hour, so perhaps UXW is the Russian embassy in London. 

A strange header was sent from UXW to RLX on 14426 kHz 21/07/95, 
09:11 UTC: 11177 40034 68983 21587 00043. Note that the last group of 
the message does not correspond to the usual brotherhood substitution 
system. 

> SOUD update: Paul Scalzo found a new SOUD station. The new station has 

callsign “SVA'. The link identifier is yet unknown. There is a sked at 
00.00 UTC on 10422.7 kHz in 75bd Baudot towards 'SVA'. The callup was in 
sloppy CW. 

-> SOUD: Rick Baker heard on 14736 kHz a new sked at 19.45 UTC on the 
WFO / MIG link. We finally know for sure where these guys are located. 
We knew already that WFO is the Russian UN delegation in New York. Now 
we also know that MIG is in Managua, Nicaragua !!! The Managua site is 
confirmed through Dave Batcho from an official US Government source. 
We also have proof that the SOUD stations are using 10 and 40bd MFSK 
Crowd36. On 16214 kHz at 10.25 UTC selcal 'VDGB' was heard followed 
by a message to link 60015 both transmitted in 40bd. The usual operator 
chatter was in 10bd MFSK. This freq was earlier used for transmissions 
from Moscow to 'FQX', link id unknown. FQX may be the callsign for 
link 60015. Here's the header: 11177 60<015 99+865 1BB77 00199 
Other SOUD 40bd freqs are: 10327, 11051, 11073, 12179 kHz with mostly 
encrypted traffic or sent in another exotic mode while unencrypted 
stuff can be found on 12128, 13398, 14632, 14659, 14817, 14823 and 
16214 kHz. 

Guy Denham writes from the UK that he caught the WQL / VNB link at 
16.30 UTC on 5775 kHz (WQL link 80061) and on 6862 kHz he heard VNB 
although he is not 100% sure of the latter. The interesting thing 
that Guy noted is the use of the digit '3' at the end of the 5th 
group. This was sent on various occasions so a typo must be ruled 
out. Guy also copied traffic to the counterparts of RVV and DZR on 
links 00149 and 20087. Here are the skeds: 

00149 RVV / RVC47. Traffic to RVC47 heard on 8057 at 17.55 UTC 
20087 DZR / RBP71. Traffic to RBP71 heard on 9237 at 17.55 UTC 

In both cases sloppy CW callup procedures were followed by 75bd 
RTTY. 


SOUD update 


o It seems that I made two serious bloopers in WUN#12. Sorry for that. 
The first one was in the SOUD update when I told you that the end 
that sends MIG is definitely in Managua. Well, that is true but the 
other end that sends WFO is NOT the Russian legation in NY. It is the 
large Russian transmitter site just outside Havana - the same site from 
which the other (one-way broadcast) SOUD transmissions come. 

o Guy Denman from Portsmouth, UK, copied a new SOUD station on 7920 kHz 
using link-id 00074. This sked starts at ca 14.45 UTC. Guy also enclosed 
a recent sked for a bunch of the European transmissions. 


Freq UTC to link 
12193 14.10 KUL 00142 
14980 14.10 RAU 00070 
10584 14.20 KUL 00142 repeat of 12193 
12180 14.30 RAU 00070 repeat of 14980 
10767 14.30 BFR 00030 

5775 15.25 WQL 80061 working VNB on 6862 
6862 15.25 VNB 80061 

7920 14.45 ? 00074 

15735 16.10 FQX 60003 

12195 16.30 GOD 00090 

10277 16.45 ? ? 

10287 17.30 JSC 00190 

8057 17.45 RVC47 20087 

9237 17.55 RBP71 00149 (also noted at 17.30 -Ary-) 
9073 17.55 UNID 

6798 18.40 KUL 00142 


o Edgar White sends us a couple of loggings along with his best wishes 
for '96. Thanks Edgar, it is a good update to the America's sked. 


Frequency to link UTC mode/speed/shift 
16226.28 clg YBU, 00148, 14:00 BAUDOT 75/500 
18803.26 clg YBU, 00148, 14:09 BAUDOT 75/500 
14725.33 clg BPA, 00116, 15:15 BAUDOT 75/500 
10422.35 clg BPA, 00116, 15:26 BAUDOT 75/500 
21865.2 clg SPK, 00168, 16:00 BAUDOT 50/500 
18844.24 clg SPK, 00168, 16:25 BAUDOT 50/500 
20731.21 clg GMN, 00119, 16:45 BAUDOT 75/500 
18185.28 clg GMN, 00119, 16:54 BAUDOT 75/500 
16446.27 clg KRN, 00178, 17:35 BAUDOT 75/500 
14465.28 clg KRN, 00178, 17:43 BAUDOT 75/500 
16446.26 clg WNY, 00139, 19:09 BAUDOT 75/500 
16841.26 clg JMS, 00127, 22:30 BAUDOT 75/500 


o SOUD. Edgar White copied SOUD when they messed up: 
14724.5 clg BAR: SOUD link 00116 1515 Baudot 75/500 Tfc 3/210 
10422.3 clg BAR: SOUD link 00116 1524 Baudot 75/500 Tfc 3/210 
This link id, frequency and schedule is normally used for calling BPA. 
Now BAR was called instead of BPA. 
He also copied a sked for SPK (link id 00168) 
QWK QDG FM 14/01 TO NEXT QWK 
FM 00.00 TO 12.00 QSW 9144/7884/13451 
FM 12.00 TO 24.00 QSW 19827/16218/13451 


SOUD update: 
o A new link has been copied on 14473.88 kHz, SOUD Moscow, link id 90039, 
txm mode Crowd36 at 12.07 UTC. 


o Guy Denman heard on 10482 kHz at 08.45 UTC on link 80061 transmission to 
VNB. Digit '3' as last figure of last group in the header is being used 
all the time now. 

He also copied at 09.10 UTC on 17474 kHz, link 10163. This one has not 
been reported for the past 6 months. This link was active in 1994/early 
'95 but had no fixed sked. 


o Edgar White writes that he noticed an odd thing: 
11144 00139 80697 20152 00809 
ZIJAXH IQXTN HOXCQ ORDIN QEGLE XGAUE RZJSY MJIMAH THLDP RYKES 
<clip clip clip> 
EDJTH LDNSR WCGOY MUSKH SKCGG YMXNC ISBBJ QYRRQ IPOWW 


11177 00139 26760 19150 00809 

ZJAXH IQXTN HOXCQ ORDIN QEGLE XGAUE RZJSY MJMAH THLDP RYKES 
<clip clip clip> 

EDJTH LDNSR WCGOY MUSKH SKCGG YMXNC ISBBJ WGQLR IPOWW 


''Message 19150 was first sent to WNY on 19 Dec., then both appeared 
together on 20 Dec. and message 20152 was re-sent on 21 Dec. Groups 1/77 
of both messages are identical, which would seem to indicate that these 
contain the real cipher text, which would agree with the encoded count 
contained in group 79. I wonder then if both group 78 and pmbl group 3 
are used to derive the cipher key ?'' 


It is possible Edgar. Except for the date and cypher group 3 nothing 
else changed, so I guess group 78 has either a connection with group 
3, the date or both. 


o Stan Scalsky noted a new sked for the txm to KAC: 2030-2100 UTC 
o SOUD update. Guy Denman sent me the current sked for the fixed links. 


Freq UTC callsign to link in contact with last heard 
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18422 


1525 
1525 
1840 
1755 
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80061 
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00190 
80061 
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00142 
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00142 
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40034 
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20087 
00070 
60003 
00098 
50079 
40078 
60003 
10024 


VNB 6862 

WOL 5775 

Broadcast 

RBP71 9237 

RVC47 8059 
? 


WQL 13423 
? 


Broadcast Rpt of 12193 
? 


Broadcast Rptd on 10582 
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VNB 10482 
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24 
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March 
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April 
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One of our other monitors writes that the Moscow brotherhood station 
has been active all day long on 9 June on 13530 kHz in 50 bd, sending 
the following very strange 5 FG message over and over again (note the 


repetitions ! 


11177 
12341 
32670 
30986 
98721 
86723 
87269 
76591 
29458 
69867 
65467 
12936 
86743 
86741 
87543 
69876 
69867 
14321 
76654 
36543 


12311 
23448 
27364 
40932 
75654 
87629 
76329 
87364 
63298 
87432 
68768 
98432 
86743 
86743 
98798 
87698 
43298 
32787 
75456 
54365 


07342 
87698 
09428 
32123 
12737 
32612 
76857 
96710 
27465 
78674 
34234 
86743 
39867 
86743 
98754 
87698 
56756 
76587 
54365 
54356 


01909 

69876 88295 
61208 74982 
49817 26346 
72727 72727 
53498 71296 
98670 27601 
27630 12673 
87326 49876 
29867 32867 
34238 68768 
43286 43286 
32867 86743 
86743 86743 
98754 98754 
69876 87612 
56123 32143 
58765 76587 
36543 54365 
36543 64356 


38743 20980 92809 02976 
36498 32764 81276 01276 
81287 65491 87364 81267 
91918 63473 67867 76732 
28756 18276 98716 87326 
56701 57601 73648 15728 
84769 28743 98127 59876 
28376 81273 98615 62875 
67867 86786 43286 43286 
62342 48273 48768 23487 
43286 43286 43286 43286 
43286 43286 43243 86743 
86743 86743 86743 43543 
29867 67543 67986 86754 
12341 34867 86798 63298 
14321 32143 14321 32143 
58765 76587 58756 76587 
36543 54365 36543 54356 
35643 54356 36543 33333 


-0-0-0-0-0-0-0-0-0-0- 
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NUMBERS & ODDITIES -=) 
editor: Ary Boender 

ary@bitbike.iaf.nl 

2:283/512.24 

Hello everyone ! In this edition of N&O we have the first update to the 
‘Brotherhood’ edition of the Newsletter and further an interesting story 
about the ‘Russian Man' numbers stations that I mentioned in WUN #2. The 
manuscript was written by Mike Chace and it looks great. Thanks Mike ! 


The 'Brotherhood' 

Thanks for the many compliments that you sent me for the Brotherhood 
special. I hope that the story made you tune in to these stations. I 
wonder if the Brotherhood also has a network in Australia. Has anyone 

in this part of the world heard stations like this ? Does anyone know 
where the stations in Europe and America's are located ? Please, tune in 
as often as you can and let me know the results. It would be nice if we 
could unwrap this mystery. As promised there will be updates to this 
article in my columns. Here is the first update to the European frequency 
list: Callsign NQX must be NXQ. 


Frequency UTC Link Mode / remarks 

16008 kHz, 9.17, 10163, F1B-75 

12136 kHz, 15:32, 00149, F1B-100 'DZR' to "Master" backup channel 
11460 kHz, 15:32, 00149, F1B-200 !! "Master" to 'DZR' (sked 15.30) 


12174 kHz, 08.00, 00052, F1B-75 to NXQ 


The mystery pip on 3754.7 kHz appears to be a time signal station 
in Krashnodar. 


Jean Michel Jarre 

The music that is used by the 'Jarre' numbers station that I mentioned 
in WUN #2 is ‘Magnetic Fields'. The station is still there on 6645 kHz 
and can be heard on Monday night at 19.00 UTC. 


The Russian Man and English Man Numbers Stations 


Mike Chace, Bath, UK 
(mikec@praxis.co.uk) 


1. Introduction 

Often heard, seldom mentioned is probably the maxim for this station. 

This may have something to do with the fact that the station seems to 

have no discernible schedule. If you want to hear it, you will need 

some patience (and a bit of the usual luck) but I can be pretty confi- 
dent in saying that you'll find either (or both) on the air at any 

time and on any day. 

Both stations are believed to be part of the same general operation from 
within the CIS, sending to agents of the KGB and GRU (Naval Intelligence). 
I should also add that there are a number of CW stations and the so-called 
German Lady that carry the same message formats and one can only assume 
that these are part of the same operation as none of the agent numbers 
appear to overlap. There is also a "German Man" but I have only heard 
this once -- I would welcome any further reports of this variant in case 
my ears deceived me ! 


2. Characteristics 


2.1. Message Formats 

Both stations are unmistakable when you hear them. Broadcast quality 
AM transmitters appear to be used. In general, the signal strengths 
received are quite phenomenal at whatever frequency. Indeed, some of 
the signal strengths are so high that it has been possible on many 
occasions to unplug the antenna from the receiver and still hear the 
station with a massive signal ! Transmitters are usually switched on 
five to ten minutes before a transmission. If you hear a strong AM 
carrier that you haven't noticed before, stay on the frequency. The 
station often "tunes up" 5 to 10 minutes before transmission with a 
steady 1kHz tone for about 30 seconds and you'll often hear some short 
snatches of the voice calling the agent once or twice. 


The frequencies used are always exactly on a kilohertz point. In 
other words, if you hear a strong carrier on 13445.5kHz, it's almost 
certainly not a Russian or English Man -- they would be on 13445 or 
13446kHz exactly. 


2.2. Voices 

The stations use the same two types of synthesized voice for each 
language. I call them the "thin" and the "thick" voice. The thick 
voice is lower in pitch, slower in delivery and generally sounds 
very labored. In contrast, the thin voice has a higher pitch, 
slightly faster delivery and sounds quite feeble. Both voices speak 
the same digits but, as we shall see later, are always associated 
with particular formats of message. 


2.3. Pronunciation 

The numbers spoken by the English Man are unique and you'll know when 
you've found it -- three is spoken as "thlee" and eight as "ate" (as 

in the past tense). It's quite unmistakable. Both English and Russian 
machines also have the same characteristic delay after any zero (or 

"noll") that is spoken. Here are the numbers as they are heard phonetically: 


No. Russian English 
4}. Adim Won 

2 Dva Too 

3 Tri Thlee 
4 Chedearia Fore 
5 Byad Fife 
6 Shin Six 

7 Shesht Seven 
8 Vojim Ate 

9 Devierd Nine 
0 Noll Zero 


3. Message Formats 
There are a number of message formats that I have come across. Each is 
detailed below. 


3.1. Format 1 

This is always spoken by the thick voice whether in English or Russian. 
123, 123, 123 -- for 5 minutes 

Pause 

Key, Key 

Group count, Group count 

5F groups, each repeated 

Key, Key 

Group count, Group count 

00000 


Null Messages (No traffic) is given as: 

123, 123, 123, 00000 -- for 5 minutes 

3.2. Format 2 

This is always spoken by the thin voice whether in English or Russian. 
123, 123, 123 (pause) 1 -- for 5 minutes 

Pause 


Key and Group count 
Key and Group count 
5F groups, no repeat 


000 

000 

Null Messages (No traffic) is given as: 

123, 123, 123, 000 -- for 5 minutes 

3.3. Format 3 

This message format is sent if there are two messages for the agent 


to be sent in the same transmission (rare). It is basically the same 
as format 2 and is again only spoken by the thin voice. 


123, 123, 123 (pause) 2 -- for 5 minutes 
Pause 
Key and Group count (Message 1) 


count 


Key and Group 
5F groups, no 
123, 123, 123 
Key and Group 
Key and Group 
5F groups, no 


(Message 1) 
repeat (Message 1) 
(pause) 2 -- for 1 minute 
count (Message 2) 
count (Message 2) 
repeat (Message 2) 


000 
000 


3.4. Format 4 

The Russian version of the station sends a format 2 (or 3) message where 
6 ("shest") and 0 ("noll") both result in a slight delay before sending 
the next digit and there is a marked pause after each ten 5F groups have 
been sent. This variant appears to be associated with long messages. 


3.5. Format 5 (Control Transmission) 

There also appears to be a short message format, directed at agent 615 

(or rarely, agent 455). In this format, there is only one 5F group sent 

to the agent at a time. I have only heard the Russian Man send this format. 
Because of the similarity with the Counting Stations "Control Transmissions' 
I also name this short message format in the same way. It's format is as 
follows: 

615, 615, 615, 1st 5F Group, repeated (for 10 minutes) 

615, 615, 615, 2nd 5F Group, repeated (for another 10 minutes) 

The two groups sent are rather curious. They are both different each day, 


do not appear to be used for more than a day and they both start and end 
with the same digit. Here are some recent examples: 


Date (1994) Group 1 Group 2 
15th July 89903 81783 
16th July 71784 73804 
18th July 63026 65506 
19th July 80740 82140 
20th July 60191 62021 
21st July 99905 91355 
22nd July 88873 80193 
23rd July 48907 40577 


My theory is that these groups are a code to the frequencies to be used 
during each day. I've attempted to find the key many times but have yet 
to succeed ! At the time of writing, this transmission can be heard daily 
at 08.00 UTC on 14890 kHz and on 11270 kHz at 08.20 UTC. The most bizarre 
example of this control transmission was heard on Sunday, 24th July 1994. 
Lasting nearly four hours in total, the Russian Man sent 615 three times, 
followed 22222 or 11111 once and then a 5F group. There then followed a 
10-15 minute break before a new set of groups was sent repeatedly for 10 
minutes. The message on that day was as follows: 


Group 1 Group 2 
72144 none 
22222 71154 
11111 72864 
11111 873464 
22222 74964 
22222 72094 
11111 72464 
22222 72764 
22222 72954 
22222 71944 
22222 72184 
11111 72604 
22222 72544 
11111 00000 


4. Message Content 

Messages appear to contain random 5 figure groups although there are 
frequent occurrences of messages which possess many double digit groups 
eg 10233, 43305, 44553 and even more strangely, never have certain digits 
at all! As an example, the Russian Man sent an 81 group message to agent 
258 on the 25th of June 1994. Not one single 5 figure group contained 
either an 8 or a 9. This is very odd and certainly indicates some non- 
random behavior (anyone with any clues please let us know). 


5. Agents 

The list of agents heard so far is extensive and indicates a wide-scale 
operation -- (5 Zeroes or 6 Zeroes indicates whether the agent receives 
Format 1 or Format 2/3 messages): 


Russian English 
Agent Zeroes Agent Zeros 
021 ? 139 6 
031 ? 182-1 ? 
087-1 6 192 ? 
102 ? 235 5 
127 5 261 5 
139 5 309 ? 
147 6 342-1 6 
176 5 395 5 
191-1 6 475 ? 
236 5 501 5 
258 5&6 541 ? 
275 5&6 562 5 
423 6 572 5 
452 5 597 5 
455 ? 729 5 & 6 
456 6 746 6 
467 5 & 6 785-1 ? 
519 6 821 5 
571 6 838 5 
573 5 854 ? 
583 5 897 ? 
585-1 6 921 6 
615 Control 934 ? 
684 ? 947 5 
697 5 982 5 
724 5 & 6 

738 5 

748-1 6 

758 5 

798-1 ? 

824-1 ? 

828-1 6 

841-1 6 

846 5 

891-1 ? 

991-1 ? 


6. The Transmission Schedule 

I have to admit that after over two years of intensive monitoring of the 
stations, I have yet to discern a schedule for either. Transmissions can 
begin at any five minute interval but most tend to start on the hour with 


a fair percentage of the rest starting at ten, twenty, forty, or fifty 
minutes past the hour. 

There also seems no pattern to the frequencies used. I have found the 
station as low as 4400kHz and as high as 16300kHz. One particularly 
fruitful area however is the range 12100kHz to 12250kHz. About 10% of 
transmissions seem to occur in this portion of the spectrum but I don't 
know why! Perhaps it's just a place where propagation tends to be optimum 
for the distances required. 

To find the Russian or English Man, I have a set of frequencies that I 
sweep through every hour, on the hour, when I'm listening. With practice, 
you will find that such a sweep can be done within the 5 minutes taken by 
the station to send its preamble. I also find it useful to search these 
frequencies at a more leisurely pace ten to fifteen minutes before the 
hour, listening for the tell tale strong, wide AM carrier signal. 


During Winter evenings (1700-QQQOQUTC) or early mornings, Summer or Winter 
(QO0O00-O80OUTC), I search: 

4400-4750, 5000-5850, 6500-7000, 7500-8200, 9000-9350, 10100-11300kHz, 
12100-12250kHz. 

During Summer evenings (to 22Q0QUTC) or daytime, Winter or Summer, I search: 
7500-8200, 9000-9350, 10100-11300, 12100-12250kHz, 13300-13600, 14350-15000, 
15800-16300kHz. 

The station follows the usual practice of following the daily and annual 
variations in propagation. This means that frequencies in the daytime are 
higher than those in the evening and Summer frequencies are generally higher 
than those in the Winter. 


6.1. Repeat Transmissions 

Repeats of messages (same time, same frequency) can often, but not always, 
be found at weekly or daily intervals. Hourly or twenty minute interval 
repeats are nearly always on a different frequency. A message is generally 
repeated on a lower frequency. I have heard messages repeated up to five 
times over a two day period. 


6.2 Concurrent Operation 

The station has at least three transmitters. Also, at any one time one, 
two or three can be in operation in any combination of languages. For 
example, the English (4474kHz) and Russian (5105kHz) stations were active 
on the 23rd Dec at 2200hrs. 


6.3 Regular Transmissions 

Despite the lack of any general schedule, each station has at least one 
regular, weekly transmission. The messages (most often null) are always 
directed to the same agent. At the time of writing these are: 


English Man 
Freq. (kHz) Day Time (UTC) Agent Season 
8074 Monday 2010 947 Summer/Winter 


10162 Wednesday 1910 947 Summer/Winter 


8074 Wednesday 2010 947 Summer/Winter 
6925 Friday 2200 572 Summer 

5875 Friday 2300 572 Winter 

14620 Sunday 1900 729 Summer 

13572 Sunday 1900 729 Winter 

13423 Sunday 1600 597 Summer 
Russian Man 

10882 Friday 2000 758 Summer 

14890 Daily 0800 615 Control 

13420 Saturday 1700 258 Summer 


The frequencies of these regular transmissions often vary by up to +/- 
15kHz according to interference. 

The stations appear to keep UTC time i.e. when the UK moves to Daylight 
Saving Time (British Summertime) the schedule remains the same. 

The first of the English Man's regular transmissions has been the source 
of some interesting monitoring. Agent 947 receives very little traffic - 
practically all messages are null (947, 947, 947, 00000). In the past year 
there have been just two messages for poor old 947. The first occurred on 
Monday the 21st March 1994 when the message sent on this day consisted of 
401 (yes! 401) 5 figure groups. The transmission lasted for nearly two 
hours. The most recent message occurred on the 27th of June 1994 when 251 
groups were sent -- a transmission of nearly an hour's duration. 


Any information about this station is welcome. You may address it directly 
to Mike or you may send it to me. 


‘till next month, Ary 


— 
Il 
! 


NUMBERS & ODDITIES -=) 
editor: Ary Boender 
ary@bitbike.iaf.nl 
2:283/512.24 
Hi, not much to report this month. Don't hesitate to send me your Numbers 
and Oddities stuff. I will not mention your name when you don't want to be 
credited, so it is safe to send me your secrets :-) 


Brotherhood update 


One new link has been noted in April: 
Callsign: RVV, Link-id: 20087, UTC: 14.20, Freq: 13.418 kHz. 
The transmissions to VKX on 14605 kHz are now scheduled for 16.10 UTC. 


Mossad 
A couple of odd messages to VLB were noted on 17/5: VLB18L36T46 for 
hours and on 18/5: VLB18P14L36R52 for hours. 


Nancy Adam Susan 

The numbers station that uses the 1940's ARRL alphabet has been noted with an 
increased number of transmissions lately. Id's include 'Susan Adam Robert', 
"Nancy Adam Susan', ‘Mary Susan Adam' and 'Frank Young Susan’. It is a bit 
curious that every callsign includes the letter 'S -Susan-' 

Frequencies: 4130, 5530, 5835, 11000, 14000 kHz. Times: all day on the 

hour, sometimes also on the half hour. 


Navy Kaliningrad 


Channelmarker 'P' has been noted on a new frequency: 4031 kHz 


VDE still going strong 

I heard this station back in '82 for the first time and it was reported by 
other dxers way before that time. I still haven't a clue about the identity 
of this station. This message was logged by Leif Dehio on 20-4-1995 at 09.45 
UTC on 6813 kHz using CW. 


VVV VVV DE VDE VDE VDE VVV VVV DE VDE VDE 

= = 9T 9T 29 29 6 6 1115 1115 = = 

76745 76745 56344 56344 34344 34344 12974 12974 571345 571345 
54345 54345 12123 12123 98933 98933 45886 45886 32355 32355 
65455 65455 23255 23255 87876 87876 34565 34565 4TAT7 ATAT7 
78411 78411 21234 21234 32355 32355 87645 87645 29892 29892 
65633 65633 34345 34345 54677 54677 65T1T 65T1T 53212 53212 
76564 76564 54343 54343 25456 25456 12387 12387 + 


MI6, the Lincolnshire Poacher 

The British Secret Intelligence Service (SIS), better known as MI6 
(originally Military Intelligence, dept.6), is reportedly responsible for the 
transmissions of the ‘Lincolnshire Poacher' numbers station. The station can 
easily be identified because of its interval signal. Transmissions start at 
the hour on three parallel frequencies with a part of the medieval English 
folk song ‘Lincolnshire Poacher'. This is repeated twelve times followed by 

a five digit identifier number. The actual message begins after a couple of 
chimes and consists of 5-figure groups. At the end of the transmission there 


are again a couple of chimes and the interval signal is played six times. 

The id-numbers are not unique, I have seen the same numbers being used during 
the past months. I haven't found a pattern yet. Maybe they are in fact agents 
numbers instead of message identifiers. The transmitter site is believed to 
be on the RAF base in Cyprus. The transmissions are always heavily jammed. On 
12-5 I monitored the station during the afternoon and evening. This is the 
result: 

1500 UTC, 11545 // 13375 // 12603 kHz, id 76728 

1700 UTC, 11545 // 13375 // 12603 kHz, id 59922 

1800 UTC, 6485 kHz, id 00283 

1900 UTC, 6959 kHz, id 79891 

2000 UTC, 6959 kHz, id 49589 

2100 UTC, 6959 kHz, id 26225 


The following sked has been noted: transmissions on the hour, times: 
1000 - 1400 UTC, 15682 // 14487 // 16084 kHz 

1500 - 1700 UTC, 11545 // 13375 // 12603 kHz 

1800 - 2200 UTC, 6485, 6959, 7337, 9251, 10426 11545, 12603, 15610 kHz 
Note: there are always three parallel frequencies. 


Espionage book 

Although it is in the shops for about a year, I found it only a couple of 
weeks ago, the ‘Guinness Book of Espionage' by Mark Lloyd. It is an 
informative book and a pleasant one to read. It contains items about spies 
and their methods, communication, equipment, incidents, several intelligence 
agencies like KGB, CIA, MI5, MI6 and Mossad. In 256 pages the writer leads 
you through the fascinating world of espionage. I think that many of the 
numbers monitors will like this book. The price is GBP 14,99 in England. 
ISBN @-85112-591-3. 


Right, that's it for now. Don't forget to write ! See ya next month. 


(=- NUMBERS & ODDITIES -=) 
editor: Ary Boender 
ary@bitbike.iaf.nl 
2:283/512.24 


Hi folks, I have some nice stuff for you this month. Check it out ! 


'Brotherhood' update 


A new sked for KKK (to KUA) can be found on 10850 kHz at 19.04 UTC. 


In our WUN-special about the Brotherhood, I told you that it most probably 
is a diplo-related network. Just recently some new and very interesting info 
came in. It seems that it is more than just diplo-related. According to 
usually well informed sources, this network belongs to an organization 
called SOUD. 

This organization was founded in 1977 by the Communist block and is 
basically an intelligence agency, accessible by all members of the former 
and still active communist block. The job of this organization is to gather 
information on everyone and everything - including their own and foreign 
embassy personnel. They are said to be based either on the premises of the 
Russian embassies and/or in separate installations. The organization's 
central computer is located in Moscow, and queries from members, regarding 
any subject are said to be handled in less than 4 hours time. 


This theory makes sense, because it would explain: 

- the use of Baudot telegraphy as some of the members don't 
have the money to get hold of sophisticated equipment and 
with so many nations involved it is of course a question of 
standardization! 

- the almost worldwide appearance of this net 

- the question "ruskih registrow ok ?" which is rather puzzling 
if this were to be a solely Russian net (see WUN#3). 

- the use of non Russian words ("bereit", "Si") 


Ok, who are they ? Little is known of the ultra secret intelligence 
organization SOUD "Soglashenije o Sisteme Objedinennowo Utschotja Dannych 
oO protiwnike" which is Russian for "System for mutual gathering of info 
about the enemy". This organization was founded in 1977 and was meant to 
serve as an electronic information gathering association between the 
intelligence agencies of the socialist camps. The members of SOUD were the 
Soviet Union, Bulgaria, Hungary, Poland, Czechoslovakia, Mongolia, Cuba and 
ofcourse Eastern Germany. They were later joined by Vietnam. 

The immediate cause for the foundation of SOUD were the 1980 Olympics in 
Moscow. To safe guard the USSR from ‘foreign hostile forces' during the 
Olympics, the main task for SOUD was to gather as much information about 
the ‘enemy' as they possibly could and store this info as comprehensive as 
possible. Because the western countries boycotted the Olympics in Moscow, 
most of the ‘enemies' didn't show up either. Nevertheless SOUD became an 
absolute hit in spy-land. Their success was so huge that they survived the 
end of the cold war and even the collapse of the communist block. 

After the foundation in 1977, it took about 2 years before they became 
active. Besides the initiator, the KGB, no agency was as fanatical as the 
East German Stasi. SOUD still gathers information about all possible 
‘enemies’ of the alliance which are stored in the main computer in Moscow 
and queries from members, regarding any subject are said to be handled in 
less than 4 hours time. 

The SOUD databanks include names of agents, zionists, hostile religious 


organizations and organizations of emigrants, journalists, diplomats, 
cultural and commercial attach s, representatives of airlines, etc etc. 
Information found in Stasi documents reveals that in 1989 more then 11100 
names were collected. Most of them included a personal description, the 
maiden name of the mother and a sample of the handwriting. 


Mossad oddity and schedules 


On 16-6, FTJ used an unusual suffix: 9 


Mike Chace sent me the latest schedule of the Mossad stations. The list 
was updated ‘till 30-5-1995. 


Frequency Callsign Frequency Callsign 
(kHz) (kHz) 
et ae See eae ts eee oa a See cee oes pte eee nce es Steele fe alee 
2270 JSR 6745 VLB 
2515 CIO 6840 JSR, EZI 
2628 FTJ 6912 OEM (occasional) 
2743 ULX 7323 KPA 
2957 SYN 7372 GBZ (occasional) 
3150 PCD, ART 7446 KPA 
3270 KPA 7540 JSR 
3417 ART 7605 VLB, SYN, CIO 
3640 VLB 7613 GPO (occasional) 
3840 YHF 7760 ULX 
4168 SYN 7866 SYN 
4270 PCD 7918 YHF 
4360 CIO 8127 CIO, MIW 
4463 FTJ 8465 SYN, CIO 
4560 YHF 8641 MIW 
4665 VLB 9130 EZT 
4780 KPA, ULX 9270 ??? 
4880 ULX 9402 YHF (occasional) 
5091 JSR 10125 CIO, KPA 
5170 GBZ (occasional) 10352 VLB 
5230 MIW, SYN,VLB, CIO 10648 YHF 
5339 OEM (occasional) 10820 VLB, SYN 
5437 ART 10970 MIW 
5531 BAY (occasional) 11565 EZI 
5560 YHF 12747 SYN 
5629 SYN, CIO 12950 MIW 
5715 ZWL (occasional) 13533 EZI 
5820 YHF 13921 CIO 
5911 OEM (occasional) 14750 CIO, MIW 
6270 ULX 15980 EZT 
6370 MIW 17410 EZI 


6500 PCD 19715 EZI 


6745 CIO 20740 SYN 


Nancy Adam Susan 

A new frequency has been noted for this station: 11170 kHz. After I 
wrote last month's column, several new callsigns were brought to my 
attention: Baker Edward Charlie, William Susan Susan and Mary Union 
Adam. Callsign FYS that I mentioned last month is actually FYP Frank 
Young Peter. The FYP, BEC and MUA callsigns contradict my earlier 
note that all callsign include the letter 'S'. Recent DF results 
pinpoint this station in either Krete or Egypt (Cairo). 


Various N&O stuff 

The 'Russian Man' numbers station has been heard on 6840 kHz at 22.15 UTC 
with a message to '507' and on 14860 kHz at 08.10 UTC with a message to 
'139'. 


Channelmarker 'R' is now also on 3194.9 kHz 


The 'Russian Counting Man' is back on 4633 kHz with endless loop tapes with 
10-counts and an unreadable callsign. The station is best heard in the 
evening (1900-2100 UTC). 


The '3-note oddity' station can be found on 4647 kHz where it transmits at 
19.00 UTC on a daily basis. This station's id is a 3-note rising scale 
‘melody'. The messages are 5F groups in AM. 


The CW version of the 'Swedish Rhapsody' station was heard at 19.00 UTC on 
5340 kHz with 5F groups after series of 'LOLO'. 


Mark Fine sent me these Spanish numbers loggings. As I have only little info 
about the Spanish stations I am very interested in everything you guys can 
provide. 
6840.00 kHz 0230s 11 Jun 95 AM 43343 Spanish Numbers - 4F/w 
//9958.00. 
9222.07 kHz 0104t 13 Jun 95 AM 43444 Spanish Numbers - 5F/w 
Calling "335", counting. Tones @0109, then "Grupo 82" 
and 5F cuts. Repeated @0116, "Fin" @0123. 
9958.00 kHz 0236s 11 Jun 95 AM 32222 Spanish Numbers - 4F/w 
See 6840.00. QRM from WRMI. 
9958.00 kHz 0301s 11 Jun 95 AM 32222 Spanish Numbers - 4F/w 
Calling 544. Into 4f cuts @ 0310. 
11491.10 kHz 1836a 10 Jun 95 AM 43343 Spanish Numbers - 5F/w 


That's all I have for you this month. Thanks to everyone who have sent 
me information. Keep it coming ! See ya next month. Bye, Ary. 


(=- NUMBERS & ODDITIES - 
editor: Ary Boender 
ary@bitbike.iaf.nl 
2:283/512.24 
Welcome to the 7th edition of ‘Numbers & Oddities'. Since last month 
the 'Miscellaneous SSB' column from Mike ceased to exist and has merged 
with 'N&O'. From now on you can send me also 'normal' stuff that doesn't 
fit in any of the other columns. 


Il 
Ne 


Channelmarkers 

I heard channelmarker 'F' from Gdansk on 4556 kHz. This is most probably 
a Polish navy frequency. It is also reported on 7039 kHz but I think that 
this is incorrect as I hear very clearly 'C' and 'S' on 7039 kHz. F (..-.) 
can easily be mistaken for C (-.-.) 


'C' is now also on 16331.85 and 'S' on 16332 kHz. 'R' is DFed and appears 
to be in Ustinov (Izhevsk) in the eastern part of European Russia. 


CIO is now also on 8025 kHz. VLB is heard on 3417 // 6270 and FTJ on 
4665 kHz. 


There seems to be something wrong with the broadcasting equipment that 
the Mossad, the Israeli military and government stations are using. 

It was first heard in the second week of June and it's still there while 
I'm writing this on July 17th. 

During that period you could here something that sounds like the ringing 
of a telephone and on top of that a sort of clicking sound. When the 
telephone sound appears, then you could hear all the Mossad transmissions 
that were on the air at that particular moment, all at the same time. On 
10125 kHz, this whole thing sounded even weirder as there is a Moscow 
station 1 kHz away that produces a constant ‘white noise’ type of sound 
which is some sort of high tech digital mode. Maybe you can imagine how 
this sounded when it all blended. The most interesting frequency was 
10125 kHz, but also on 8127 kHz something unusual has been heard. This 
Mossad frequency carries on USB Israel Defence Forces Radio (Galei Zahal). 
It was first thought that this was KOL Israel but it appears to be Galei 
Zahal's traffic information service which carries mostly music and id's 
as "Kol Ha-Galgalatz" ("Voice of Galgalatz"). News summaries are some- 


times carried on the half hour with some news bulletins relayed from Kol 
Israel Israel's Network B on the hour. During the Galei Zahal broadcasts 
the same situation occur as on 10125 kHz. The same happened to a couple 
of RTTY stations who apparently transmit from the same site just like 
Galei Zahal. The transmitter site is near Tel Aviv. Maybe this is still 
going on when the Newsletter comes out. Try your luck on 10125 kHz. 


MI6 

Apart from the well known ‘Lincolnshire Poacher' station, MI6 also 
operates another, less frequent heard, station. This station uses an 
interval signal that sounds like the old folksong ‘Cherry Ripe' and 

is played on a flute. I heard them recently on 14469 kHz at 13.00 UTC. 
They have been noted on 17499 kHz at 12.00 UTC as well and at 13.00 UTC 
on 20474 and 23411 kHz. The station is known to Numbers-dxers as ‘the 
Cherry Picker' 


Nancy Adam Susan schedule 


20.00, 5530 kHz, NAS 
21.00, 4130 kHz, MSA / RSM 


Brotherhood update 

A new sked for messages to RAU can be found on 13880 kHz at 08.10 UTC. 
UXW has a fixed sked at 09.10 UTC on 14426 kHz with RLX in Moscow, the 
other end of the link is on 13506 kHz. The link id for both stations 
is 40034. 


8BY / P8K 

Recently number station '8BY' has been DFed and it appears that it is 
operating from France, somewhere near Paris. The user is unknown but 
there are rumors that it might be DGSE related. Frequencies: 7668, 
10248, 12170, 14931 and 18302 kHz. Another station that is around for 
many years is 'P8K' which will be DFed during the next couple of weeks 
and I would not be surprised if this one comes from France as well. 


The USAF numbers broadcasts, pti. 

They are there for many years; easy to catch and yet completely ignored by 
the majority of the dxers. A bit strange when you know that there are many 
numbers-dxers who spend years to figure out how the numbers stations work, 
who are looking for patterns and try to break the codes. Yet they ignore the 
EAMs and Foxtrot messages. Therefore I thought it would be nice to take a 
closer look to these messages. We'll kick off with the Foxtrot or 'Skyking' 
messages, which all of you probably have heard before. They can be heard on 
all GHFS frequencies. 


Here's a sample: ''Skyking, Skyking, do not answer. Papa Tango Three. Time 
Three Five. Authentication Whiskey November. I say again; Skyking, Skyking, 
do not answer. Papa Tango Three. Time Three Five. Authentication Whiskey 
November. Croughton out.'' 


Perhaps the most common question asked by a new military ute monitor is the 
question "who is this SKYKING character, and why can't he answer?" These 
broadcasts to SKYKING are more commonly known as FOXTROT broadcasts. You can 
read about them in Larry Van Horn's Utility World column in the Dec 94 
Monitoring Times (which includes a picture of a USAF FOXTROT broadcast pad). 
As with the EAMs, they are usually ignored when they are broadcast on the 
GHFS. Most of the information below is derived from posts on the Grove BBS. 
I thank the participants in the discussions on the BBS, in particular Jeff 
Haverlah who wrote the major part of this article. 


What follows is not ‘'who' or ‘'what' these "SKYKING" broadcasts are, but 
rather how they seem to manifest themselves on HF, at least from a CONUS (= 
CONtinental USa) viewpoint. 


The construction of a Foxtrot message is as follows: 'Skyking, Skyking, do 
not answer' is the normal callup text for Foxtrot messages. This is followed 
by a 'trigraph', 'timestamp' and ‘authentication’. 
Trigraph 
All characters of English alphabet can be used. All numerals from 
1 though 9, plus zero are used. There are all alpha-character tri- 
graphs; combinations of alphanumeric trigraphs; and all numeric 
trigraphs. The trigraphs NEVER change during a FOXTROT cycle. 
Timestamp 
Two digits that represent the minutes-unit of time of the broadcast. 
The digits will change to reflect the time of broadcast by a specific 
station. Sometimes, the stations seem to fudge the timestamp (mis- 
sing the minute-change. ) 
Authentication 
Conventional Wisdom - the ‘alpha''alpha' authentication does not 
change during the echo cycle. Common situation now - the ‘authen- 
tication' does indeed change during the echo process. Yet, there 
are still instances where the 'authentication' does not change. 


In multiple FOXTROT situations ("more to follow"), the ‘authenti- 
cations' are static across each message (each authentication is 
the same for each 3/2 DNA.) If the authentication changes in mid- 
rotation, it seems to change for each grouping in the cycle at the 
same point. 


The Foxtrot messages appear to have the highest precedence of any 
transmission on the GHFS. Example of precedence: 

> All GHFS traffic will cease for an EAM transmission. 

> All GHFS traffic will cease for a FOXTROT transmission. 

> All EAM transmissions will immediately terminate for a FOXTROT bcst. 


Other presumed FOXTROT broadcasts: 'YELLOWBLOOD' 3/2 DNAs heard on 6788, 
11191, 11244 kHz. Presumed USN related; possibly USMC. But not sure. The 
station that broadcasts these transmissions never id's itself. The broadcast 
is sometimes echoed by at least one other station, again with no id given. 
These broadcasts sometimes indicate the use of a schedule. Example: +/- h+53 
minutes in late 1994. Transmission pattern: 'YELLOWBLOOD, YELLOWBLOOD. Do not 
answer. Break "trigraph timestamp authentication."' 


As mentioned above, these broadcasts have apparently been around on the U.S. 
HF military frequencies for decades. The transmission patterns and 
frequencies changed somewhat in 1992 and since 01 June 1992, they have 
manifested themselves on the GHFS as follows: (note: although the following 
is the result of many years of monitoring these messages, some of the info 
given is ‘tentative’. Your comments or adjustments are highly appreciated 
-Ary-). 
1. This is tentative: Take a world map and draw an arc beginning at 
Hawaii; through ELMENDORF; through THULE; through CROUGHTON; and 
ending at LAJES. The FOXTROT broadcasts heard from stations inside 
the arc seem to be different from those heard at or outside the arc; 
and, they do not seem to cross the arc. 
A) Within the arc: 
-> For at least a few months after the 'change' in June 1992, the 
lead GHFS station would 'call' MCCLELLAN and ANDREWS and ‘request 
you echo the following'; then broadcast the ‘trigraph', 'timestamp' 
and ‘authentication’. 
-> Maybe concurrently, or maybe after this brief period of time, the 
lead station (usually OFFUTT, but sometimes ANDREWS or MCCLELLAN 
following the old USAF SAC universe) would initiate a FOXTROT broad- 
cast with a call to something that still sounds like DECENT (or maybe 
DESCENT??) with a ‘request you echo the following.' The DECENT call 
appears to be a general call to all CONUS (less BAYONNE) and SOUTHCOM 
GHFS stations to 'echo' the FOXTROT broadcast. The SOUTHCOM station 
being ALBROOK - if it is not a SOUTHCOM activity, at least it is 
apparently for coverage of the southern U.S., Gulf of Mexico, Carib- 
bean (Cuba area?), and who knows what else. 
-> Until around March 1995, the echo process seemed to flow from the 


lead station (usually OFFUTT) to MCCLELLAN/ANDREWS; to MACDILL; 
finally to ALBROOK. Since March 1995, it seems to be catch as catch- 
can with ANDREWS sometimes coming up as trailing in the rotation. 
Since around March 1995, there have been rare (but not uncommon) 
FOXTROT broadcasts that use a callsign that sounds like FAIRLY. 
These broadcasts also ‘request you echo the following'; however, 

no echo is ever heard, at least here. A FOXTROT broadcast was heard 
recently from YOKOTA (very strong level here in post-sunrise local 
time) with a broadcast that seemed to be directed to something that 
sounded like FARLY - possibly accented FAIRLY?? Again, no echo heard. 
Very recently OFFUTT was heard with a FOXTROT broadcast using the 
callsign ENLIST. Again, no echo was heard. 

And sometimes OFFUTT and ANDREWS have been heard (during periods of 
good propagation) with a single FOXTROT broadcast, with no callsign; 
no request for echo; and, no echoing station following their broad- 
casts. 

B) Outside the arc. Because of propagation, the following is also 
tentative: 

Stations such as HICKAM, THULE, and CROUGHTON can be heard here at 
local night with FOXTROT broadcasts that do not seem to originate 
with a CONUS station; and which do not seem to be echoed by CONUS 
stations. Question: who initiates these ? 

These stations at and outside the arc, when they are co-active with 
OFFUTT during an OFFUTT DECENT broadcast, seem to ignore (or not 
hear) the OFFUTT broadcasts, and do not take part in the FOXTROT 
broadcast rotation (if any). 

When propagation is good (which is certainly not at this period of 
time) YOKOTA has been heard with what appear to be ‘initiating' 
FOXTROT broadcasts. Are there others ? 

C) Apparently the only stations not participating in any FOXTROT 
broadcast are BAYONNE, and ASCENSION. 


. The FOXTROT broadcasts are heard on all GHFS frequencies. Unlike 


the EAMs, the FOXTROT broadcasts are not heard on the old/new 
GIANT TALK frequencies since 01 June 1992. 

Before the SAC 'standdown' these broadcasts were equated with 
something called a ‘monitoring period.' After the 'standdown' 
they are equated with, well, what?? They can happen at any time, 
and do. 


Next month we'll take a closer look at the EAMs. I'd like to thank 
Enigma, Mike Chace, BBC Monitoring Service, Leif Dehio, Jeff Haverlah, 
Larry van Horn and all the others who sent me their findings. Keep it 
coming ! ‘till next month, Ary. 


(=- NUMBERS & ODDITIES -=) 
editor: Ary Boender 
ary@bitbike.iaf.nl 
2:283/512.24 
This month we're on the Magical Mystery Military Numbers Tour. I hope you 
will like it. Enjoy ! Oh, and don't forget me. Send me so much news and 
stuff that I have to hire someone to sort it out :-) 


Various stuff 

-> A very rapid 'R' was heard for one night only on 3833 // 3768 kHz on 
2-8 all night long. This was probably the French Air Force testing the 
equipment because FDC (FAF Metz) has been heard on both frequencies for 
almost a week now. 

-> Mossad also seems to use VFT systems for their transmissions. 

-> The 'Brotherhood'/SOUD stations RLX & UXW were extremely busy during 
the London conference on Bosnia, RLX sent monster messages to UXW for 
over an hour, so perhaps UXW is the Russian embassy in London. 

A strange header was sent from UXW to RLX on 14426 kHz 21/07/95, 
09:11 UTC: 11177 40034 68983 21587 00043. Note that the last group of 
the message does not correspond to the usual brotherhood substitution 
system. 


‘Beacon' mystery unwrapped 

Most of you must have heard them, the 4-character callsigns that 

haunt the 2-5 MHz bands. Even with the current poor conditions lots 

of the stations have booming signals during the evenings in Western 
Europe. In a feature in the June '86 issue of Popular Communications 
they are called ‘Commercial beacons'. After all these years I still 

do not get what the author meant by that. Anyway, they are everything 
but commercial. Just like the single letter channel markers, these 
stations are Eastern European military stations with Russia as the 
major participant of course. 

The transmissions are loaded with Q-codes and often 5F groups are sent. 
The stations are using CW upto 30 wpm and the callsigns always consist 
of 4-character groups either 1 digit and 3 letters, 2 digits and 2 
letters or 4 letters. Note: there are no combinations where 2-digits 
are next to each other except in the middle of the callsign (eg A12B, 
no 12AB or AB12). Here are a couple of typical lines. Each line comes 
from a different station: 


VPV6 DE 3AYJ QRU? QSA3/4? OK? 

CMMU DE 5E9S QTA QTX RPT 

VVV DE 9AKO QRK3? QRU QSA? RPT 

9Q9L DE DCNE. QSA2/3 QRQ16 QRK4 QRU? QRU QLW QRU? 
Q6VH DE HK1M QAP? 


OVQC DE PRIIJ QLW QSA2/3 QRK QRU NIL 

MDBS DE QPYA OK QTC 149 QRQ14 RPT AA? 

3PIQ DE 3INP QSA? 

Z6GO DE TO7R (followed by 5F groups) QJG QRO QYT1 QRV 
IGDK DE HK1M QYT6 QYT8 OK? QSX? 


This one is a bit different from the rest of the stuff. These messages 

pop up every now and then on 4602.5 kHz. They are repeated 2 times. 

XXX XXX ESUP ESUP 45530 26798 BATIST (heard on 4-7) 

XXX XXX ESUP ESUP 06365 BARWINOK 570 (heard on 6-7) 

These messages are transmitted by the Net Control Station (ESUP in this 
case) and begin always with 'XXX XXX'. The messages are probably staff 

messages like the USAF 'Skyking'. This is a Russian duplex network and 

you can find the other end on 4937.5 kHz. 


For those who are not familiar with the Q-codes, here's the transla- 
tion. I must say that there were a couple of new ones for me too ! 
Note: the meaning of these Q-codes differ sometimes from the same 
amateur or maritime Q-codes. 


QAP = keep listening on ... kHz 
QJG = revert to automatic relay 
QLW = test transmission 


QRKx = the intelligibility of your signals is x. Where x is 1.bad, 
2.poor, 3.fair, 4.good, 5.excellent 

QRO = increase transmitter power 

QRQx = transmit with x words per minute. 

QRU =I have nothing for you. 

QRV = 1 am ready 

QSAx = the strength of your signal is x. Where x is 1.barely readable, 
2.weak, 3.fairly good, 4.good, 5.very good 


QSX =I am listening to ... (callsign) on ... kHz 

QTA = cancel message nr... 

QTC = 1 have messages for you 

QTX = stop with.... (depends on the code following QTX) 


QYTx = reference to another transmission, where x marks the number of 
the transmission. On 4602.5 kHz, the highest number used is 8. 
RPT AA = repeat all after 


The most active frequency was 4602.5 / 4937.5 kHz during the past few 
months, followed by 4119, 3067 and 4058 kHz. I logged the following 
stations during April-July: 
3067.0 kHz, NSNO, NT73, E68W, KR1K 
4058.0 kHz, 3INP, 2M8V, 4B7C, Q8TC 
4119.0 kHz, OTBA, VVYV, TO7R, WLGL, 1J4W, AWVB, VA7I 
4601.0 kHz, RGC7 (w/Z4C5 on 4602.5 _not the same network as 4937.5_) 
4602.5 kHz, 3AYJ, GAGX, 8NLG, BASG, 9AKO, SVAK, ESUP, 5E9S, Z4C5, 
CHLN, VDHN, MBJX, W6HA, HJSN, QPYA, HKMR, KOAT, CMMV, 
HK1M, AEKN, 8MKR 


4937.5 kHz (other end of 4602.5) 


This frequency list is far from complete. It is based on the activity 
during the past 3 years. During that period activity has been noted 
on the following freqs: 2238, 2285, 2302, 2362, 2546, 2733, 2748, 
2854, 2878, 3055, 3064, 3067, 3089, 3228, 3256, 3282, 3286, 3298, 
3486, 3803, 3831, 3938, 4058, 4119.5, 4601, 4602.5, 4898.5, 4951.5, 
5058, 5117, 5138, 5144, 5153, 5241, 10038, 13207 kHz. 


Please note that not all 4-character stations on these frequencies 
belong to the Russians. The 4602.5 / 4937.5 link is Russian, while 
the Czech Army can be found on 5144 kHz, but there may be other 
Eastern European stations as well. As usual, the stations quite often 
change their frequencies, so you have to search for them but you'll 
find them soon enough. 4602.5 kHz seems to be deserted at the moment 
but judging from the past, they will return sooner or later. 


Tip: when you see the 'XXX XXX' messages, then you have a very good 
chance that you caught a Russian station. These messages can also be 
helpfull to define the various groups of stations on these networks. 


Timesignal stations ? Nope ! 

Another type of mystery station that is around for quite some time, 
is often wrongly indicated as a time signal station. In fact, this 

is not one single station but a network of stations belonging to the 
Russian forces. To the Russian Air Defense Forces to be more precise. 
This is a typical message that can be best described as a QRV message: 
'BT990457??8??2??'. The digit after the first two question marks is 8 
on 3839 kHz but may be different on other frequencies. Each message 
starts with BT -...- followed by 99 and the time, being UTC+x. Then 
two question marks ?? ..--.. followed by a digit and again five 
question marks. Each message that starts with another combination 
than 99 is followed by a 'normal' message. The combination consists 
of 2 equal digits like 44, 66 etc. The messages have a length of 13 
characters (including BT), the QRV messages count 16 characters. 

The time that is transmitted on these stations is not very precise, 
it is often 1 to 3 minutes off. The timestring can vary from station 
to station from UTC+3 to 6 or even up to +12 hours, depending on the 
geographical area that the station serves. 


These stations have been heard on many frequencies. Here is the list: 
2316, 2360, 3825, 3839, 4402, 5053, 5181, 5205, 5214.5, 5369.5, 6635,=20 
6800, 7530, 8084 kHz. At the moment 3839 and 6635 kHz are quite active 
in the European evenings. 


In the early 90's a similar station could be found on 5416 kHz. It 
transmitted in 50bd RTTY and sent the following QRV message: 


VV99+1804+0++++++ The timestring was UTC+1. Just like the CW stations, 
this also was a military station. Probably belonging to the Russian 
forces in Eastern Germany or the East German forces. 


The USAF numbers broadcasts, pt2. 

I am sure that every person who regularly listens to GHFS stations 
have heard the character strings commonly known as EAMs (Emergency 
Action Messages). So, what's an EAM ? This definition of an EAM is 
taken from a USAF Manual: ''Joint Chiefs of Staff Emergency Action 
Messages contain key instructions or information from high level 
authority and have predetermined formats. Such messages are trans- 
mitted by various communications systems and normally carry FLASH 
precedence. They are vital messages of an extremely time-sensitive 
nature, and rapid processing is mandatory to obtain the fast reaction 
required by their content. Usage and handling procedures are of the 
highest classification and have been issued by the Joint Chiefs of 
Staff only to those who have a need to know. '' 


Sample EAM: 

''Alpha Romeo Yankee Four One Tango standby. Alpha Romeo Yankee Four 
One Tango standby. Alpha Romeo Yankee Four One Tango standby, message 
follows. Alpha Romeo Yankee Four One Tango Bravo Two Charlie Delta 
Oscar Three Five Seven Lima Hotel Six Quebec Uniform India Juliet Mike 
Zulu Kilo Papa Foxtrot. Offutt out.'' 


The following information is a small subset of what has appeared on 

the Grove BBS since July 1994. It was compiled for this article by 

Jef£ Haverlah. The information grew out of an attempt by Larry Van Horn 
and Jef£ to discover what was common on the GHFS so that the ‘uncommon' 
becomes noticeable. This is what Jeff writes: 


As with most hobbyists, EAMs were something to hear but ignore. When I 
took the time to actually listen to these things, ‘conventional wisdom' 
went by the wayside! 

1) All EAMs consist of two parts - A 'preamble' that consists of 6 
characters (a change from 5 characters at the June '92 demarcation) ; 
and the body of the string, which is read as a concatenation of the 
preamble and the following characters in the string. 

2) The first two characters of any preamble are static (they do not=20 
change) over a period of time. It's these two characters that help 
you denote the character-count type of EAM that you are hearing. 

3) In counting the characters in an EAM string (including the preamble) 
you will find: 

-> The most common EAM consists of 26 characters, with a preamble whose 
first two characters remain static for a period of time that seems 
to vary from 26 days to as low as 8 days; and before Dec 94 seemed 
to stay static for an average of 2 weeks. (It's 'D5' now -Ary-). 


-> Also very common is the EAM with the same static characters as the 
26-count EAM, but consists of 20 characters. 

-> From around the end of Nov 94 to maybe April 95, there was a rare 
EAM with the 26-character EAM's static characters that was 6 charac- 
ters in length (an EAM that consisted of only it's preamble). When a 
6-character EAM was heard, with rare exception, it would seem to be 
part of a 6/20/26 character EAM set over a 15 minute period. Around 
the time that the 6-character EAMs seemed to disappear from the GHFS, 
there appeared a new 'set' that seemed to consist of a grouping of 
20/20/26 character EAMs over a 10 minute period. Here's an example: 

11244 .0 2049z 03/03/95 OFFUTT with MAINSAIL. 
2049z QJI24AY 7NYEBR5F25PV54 (20 character) 
2054z QJ3WAX NSFKTXSTU7EB5P (20 character) 
2058z QJUCU4 2FS7EKHW7UK325UYAW3G (26 character) 

-> In a marked change from the (6)/20/26 character set EAM universe, 
there are rare transmissions of what I call variable-character EAMs 
(but probably should call variable character-count EAMs.) These are 
EAMs whose character-counts can vary from maybe the low 20's to massive 
EAMs that can have multi-hundred character counts (the highest heard 
by me so far is a 500+ character EAM on 19 May 95). As with the 20/26 
character-set EAM universe, these variable-count EAMs are denoted by 
the first two characters of the preamble, which seem to remain static 
for a period of time that seems to average 2 months, sometimes much 
less, sometimes much more. As heard by me in North America, there seem 
to be no more than 2 different static-character sets active at any one 
time in the variable character-count universe (as this is written, 
R3... and YY..). But, based on two loggings by Ary Boender, there may 
be a third set (M3...) that seemed to be co-active with the R3.. EAMs, 
at least as heard in Europe. (Unusual vs. usual, remember? Which leads 
to the question ‘are there different character sets in use outside of 
CONUS' ) 

4) The EAM itself is of interesting construction: 

-> The EAM character-set (since Jul 94, when the monitoring started) 
consists of 32 characters: 

A) All 26 characters of the English alphabet. 
B) Numerals 2, 3, 4, 5, 6, and 7 (six characters). 
C) There are no zeros, ones, eights, or nines. 

-> In the variable character-count EAM universe, there are occasions 
when there are multi-character '‘groupings' within the EAM that will 
repeat in the body of the EAM; and, sometimes maintain relative 
positions throughout the body as they repeat. 

5) There can be distinctive transmission patterns in these things: 

The EAMs heard on the GHFS are first heard on the NIGHTWATCH nets 

on the old GIANT TALK frequencies, plus sometimes still on USN 

freqs. Usually broadcast by a daily tactical callsigned station, 

who is the same station each day (sometimes with the same operators), 
just using a different callsign. The operator works in a very noisy 
environment - trigraphs, character strings, ‘warble tones' can be 


6) 


heard in the background. The operators also use very distinctive 
diction. Sometimes, the initiating station is NIGHTWATCH 01 itself. 
Within a few seconds, to a few minutes of this broadcast, the GHFS 


will lightup with a very powerful carrier, followed shortly by OFFUTT, 


ANDREWS, or MCCLELLAN with a call to MAINSAIL and start the GHFS 


rotation of the EAM. (There can be slight variations to this pattern. 


Rarely, NIGHTWATCH 01 will pull a station such as MACDILL off to a 
published discrete frequency, where NIGHTWATCH 01 will dictate the 
EAM to the GHFS station 'for injection to AUTODIN.' Within seconds 
of completion, this EAM will be transmitted on the GHFS. 

Usually, an EAM is broadcast once on the NIGHTWATCH net; once on the 
GHFS (by all stations except ALBROOK, BAYONNE, and ASCENSION); and 
that's it. Recently it's been noticed by Ary Boender and myself that 
CROUGHTON and ANDREWS will rebroadcast an EAM (sometimes at an 
apparent hourly schedule) hours after the initial GHFS cycle was 
completed. Also, during self-described exercises the NIGHTWATCH nets 
will repeat one or more EAMs constantly over varying periods of time 
but is not joined by the GHFS. 


On somewhat rare occasion, an EAM can be transmitted 'for' a callsign 


or multiple callsigns, in which case the message starts something=20 

like this: ‘for Chewing Gum, for Chewing Gum' followed by the EAM. 

A) Almost always these 'For...' EAMs are 20 characters. 

B) Very rarely, they can be variable count EAMs: EAMs '‘for' 
theaters/commands, and something a few months ago for SOARHAWK. 


) 


C) 


D) 


On 


the most recent EAM is called ‘current traffic. 


The only 'for' callsigns that seem to be static in nature (besides 
the Theater/Command things) are EAMs 'for' REGION “alpha character" 
(heard: ALPHA; BRAVO; CHARLIE; DELTA); and variable character-count 
EAMs 'for' SOARHAWK. 

They can happen at any time, but an apparent favorite time for 

these is between 1200z-1300z (1300z-1400z Standard time) on Tuesdays. 
the NIGHTWATCH nets, the EAMs are called 'traffic.' Usually, 

' Stations ‘entering 


the net’ that do not have ‘current traffic' are immediately read the 
‘current traffic' after the authentication process is complete. I 
have heard only one instance on the net, at the end of a long exercise 


in 


March' 95, where these things were called "Eee Aaa Emms". 


I'd like to thank Jeff for this in depth EAM article, Carter Bennet and 
Larry van Horn for their input, Carter for the EAM checker and of course 
the NN guys who sent me some useful stuff as well. That's all for now 
folks. See ya next month, Ary 


NUMBERS & ODDITIES 


editor: Ary Boender (ary@bitbike.iaf.nl 2:283/512.24) 
Lobeliastraat 33B, 3202 HR Spijkenisse, the Netherlands 


Hi folks, an error has crept into my EAM sample in last month's column. 
I included a ‘one' in the sample message but after reading the whole 
story I'm sure you all know by now that there are NO ‘ones' in EAM's. 
This month's special edition of N&O is about spy stations. Not the 
normal, average spy stations (YL with 5F groups) but the digital ones. 
C37A and 6XM8 were the cause of many discussions amongst dxers during 
the past few years. Several dxers -amongst them also WUNners- have been 
following these stations for years and one of them sent me the following 
very interesting manuscript: 


Today I'd like to introduce you to a rather mysterious group of stations, 
that seem to have no connection but are all centered around one of the 
Israeli intelligence services (MOSSAD, LAKAM, AMAN or SHABACK) . 


Probably most of these stations are known to you already, but there 
seems to be a lot of uncertainity as to who is behind them, so it may 
be worthwhile taking a closer look at them. 


The following calls appear to be involved in this multinational 
operation, although there are probably a few more which we haven't 
found out about yet: C37A, 6XM8, CJL, WII, TFB, RSB1 (QRT?), CIF9, 
PTI2, CAM, M4W, RK2, KWO (QRT?) 


'C37A' and '6XM8': 

These two stations are the most active in the net. They have a daily 
sked, 7 days a week, which normally starts at 04:30 UTC and continues 
nonstop until 19:45 UTC (Mo.-Fr.) or until 15:30 UTC (Sat.& Sun.). 
Modes used are ARQ-E with 288 Bd and normal Baudot telegraphy with 
100 Bd, which is used for operational procedures only. Traffic in 
ARQ-E is always encrypted, using a very effective combination of 
encryption and data compression. 


'C37A' is located in Israel, not very far from Tel Aviv. This was 
checked out by locals in the outskirts of Tel Aviv (sig. rep. was 
59+20dB and no fading on the signal during lousy conditions) and 
also confirmed with the help of professional grade DF-equipment. 


'6XM8', the other end of the link, is located in Germany, probably 
not more than 100 Km from the city of Bonn. Although we have no 
proof, all the data gathered so far, hints at a station run by the 
German intelligence service (BND). 


It is still unknown where exactly the station is located. Monitors 
in the Bonn area, living very close to the German MFA-building and 


the Israeli embassy, gave the station a rather weak ground wave 

signal. This more or less rules out involvement by either of the two 
installations, which both have huge HF antennae on the roof. However 
various attempts were conducted to DF the station and each time Bonn 
appeared to be the source of the signal. The most likely transmitter 
site is the region northwest of Bonn, bordering with Belgium. This 
region is packed with military and other dubious installations, and 

the ideal place for such a low profile operation. We think the site 

may be located near the town of Monschau, in a place called Hoefen. 

The BND is known to have a very large monitoring installation in Hoefen. 


Although it would appear strange to use a monitoring station for trans- 
mission purposes, the BND seems to do just that (eg.the now closed DEA47 
in Husum), using the name "Bundesstelle fAr Fernmeldestatistik" as a cover. 


The '6XM8' transmitter site seems to be used by the BND number stations 
(eg. "Kilo Whiskey"), as well as a couple of other ARQ-E outlets, running 
at 288, 192 and 96 Baud, always encrypted. Operational messages are sent 
in CW. 


These German stations can be heard on the following frequencies: 
13903 ARQ-E-96, 14950 ARQ-E-288, 15641 ARQ-E-288, 16327 ARQ-E-96, 
16350 ARQ-E-288, 18768 ARQ-E-288, 18772 ARQ-E-288, 20950 ARQ-E-192 


These links seem to be directed to other partner intelligence 
services of the German BND. 


The messages sent by 'C37A' to Germany consist of encrypted English 
text or 5 LG@s which are also encrypted using the online compression/ 
encryption algorithm. 

You can tell 'C37A' and '6XM8' apart by looking at the shift. The 
Israeli side uses 330-340 Hz on both ARQ-E and Baudot, whereas the 
German side uses a narrow 190 Hz. The Israelis transmit at 100.87 Bd 
and the Germans use exactly 100 Bd Baudot. 


Here is the current 'C37A'/'6XM8' frequency list: 


Frequency Channel nr. Callsign Mode 

7569.50 (??) C37A ARQ-E-288/ITA-2 100.87 
9208.00 (53) 6XM8 ARQ-E-288/ITA-2 100 
10348 .00 (54) 6XM8 ARQ-E-288/ITA-2 100 
10749 .50 (??) C37A ARQ-E-288/ITA-2 100.87 
11434 .50 (??) C37A ARQ-E-288/ITA-2 100.87 
12224 .50 (??) C37A ARQ-E-288/ITA-2 100.87 
12276 .00 (56) 6XM8 ARQ-E-288/ITA-2 100 
13073 .50 (25) C37A ARQ-E-288/ITA-2 100.87 
13419 .00 (57) 6XM8 ARQ-E-288/ITA-2 100 


14379.50 alternate during QRM C37A ARQ-E-288/ITA-2 100.87 


14386.50 alternate during QRM C37A ARQ-E-288/ITA-2 100.87 


14390.50 (??) C37A ARQ-E-288/ITA-2 100.87 
14398.00 alternate during QRM C37A ARQ-E-288/ITA-2 100.87 
15688.00 (59) 6XM8 ARQ-E-288/ITA-2 100 
16312 .50 (28) C37A ARQ-E-288/ITA-2 100.87 
16457 .00 (60) 6XM8 ARQ-E-288/ITA-2 100 
17387 .00 (61) 6XM8 ARQ-E-288/ITA-2 100 
17422 .50 (??) C37A ARQ-E-288/ITA-2 100.87 
17427 .50 (??) C37A ARQ-E-288/ITA-2 100.87 
17437 .50 (??) C37A ARQ-E-288/ITA-2 100.87 
18547 .50 (??) C37A ARQ-E-288/ITA-2 100.87 
18557 .50 (??) C37A ARQ-E-288/ITA-2 100.87 
18275 .00 (62) 6XM8 ARQ-E-288/ITA-2 100 
20465 .50 (??) C37A ARQ-E-288/ITA-2 100.87 


The following traffic from 'C37A' to '6XM8' shows that decisions are made 
on the Israeli side of the link: 12:55 UTC 12.May.95 13072.50 kHz. (C37A 
was having serious problems with encryption device/no synch. possible) 


it is ok with me 

no hard feelings 

we will try again and if it wont work 
i will a ask prommuission to qrx 
ok///zar 

ok ok ok 

(--- THEN TO ARQ-E-288 BUT NO SYNCH WITH '6XM8'---) 
(--- BACK TO BAUDOT---) 

ok ok ok, 

ok ok 

but pls pls as as as 

i have to get aprovel 

ok ok ok, pls as 

tks tks tks 

as 5m 

(--- PAUSING FOR A COUPLE OF MINUTES ---) 
good news 

we can close now 

it was a pleasure working with you 

ok ok 

many thanks and regards 

xxkk 

i dont understand 88 

(--- PAUSING FOR ABOUT 2 MINUTES ---) 
ok 

to you too 

gb gb gb gb gb gb 

(--- S. OFF ---) 


The Israelis have problems with their equipment very often. In August 
the link was down for several weeks due to technical problems with the 
encryption device. They were back to normal on 23/08/1995. 


'CJL' and 'WJI': 

'CJL' is a station which is listed in many publications as the Cypriotic 
MFA in Nicosia. The location may be right, however the user is again one 
of the Israeli intelligence services. 


'WJIT', the other end of the link is a station located in Italy, probably 
somewhere in the north-eastern part of the country. This was indicated 

by rough DF-analysis and propagation characteristics. The user is probably 
one of the Italian intelligence services. 

There are normally 3 skeds per day, with limited weekend activity. From 
Monday to Friday you can hear both stations at 07:00, 11:30 and 15:00 UTC 
Saturday normally has 1 or 2 skeds only. 


The regular frequencies in use are 16339.50 kHz ('CIJL') and 17526 kHz 
('WJI'). Modes used are ARQ-E-96 with a 4 character rep. cycle and 100 
Baud Baudot for the call-up procedure. 


The following technical problems, operator errors, operator chatter, 
technical data and transmission characteristics gave away the real users 
of 'CIJL' and ‘WJI', thus definitely ruling out the MFA Nicosia theory: 


- 'WJI' signed off with "ciao @@@@@ shalom". 


- 'CJL' uses Baudot with 100.87 and 340 Hz, whereas 'WJI' uses Baudot 
with exactly 100 Baud and 850 Hz shift. Like on the link from Israel 
to Germany, these characteristics show the use of different equipment, 
indicating a multinational operation. 


- The past weeks 'CJL' transmissions often carried the audio of the 
MOSSAD-number-station transmitting on 17410 kHz. 


- The date-time group used by 'WJI' is in Italian, the one used by 'CJL' 
is in English. Cypriotic diplos would for sure not use Italian date 
time groups ! 


- 'CJL' was heard several times, accidentally transmitting in 3-channel 
VFT FEC-A-192, a mode used by several other Israeli intelligence outlets 


The traffic sent on this link consists of 5 LGs, using the NATO encryption 
system called AROFLEX. Here is a sample of a message transmitted by 'CJL' 
to 'WJI'. You will notice that the first and the last group of the message 
are identical, and that groups 2/3/4/5/6 are identical as well. 


cjl 
ryryryryryryryryryryryryryryryryryryryryryryry 
i ga ga 


nr05 

170047z july 95' 

bt 

bsdwf arjun arjun arjun arjun arjun ylfvo loedb ngscm xmlcv 
zldpk msppd rkqco ofksf ypecd ftzqc swopq mdkeq qsrox novey 


(eer nda tt oats, ts rest deleted ........... ) 

page 2 

olywv ctneo zzwgh zzcxa smyxs eioex goojh updvu fuhmw vpbkr 
Goce trs correc rest deleted ........... ) 


kjnax wunmr zybqw ngahc tovnl rioub tjaia xakbf dljap qtlqn 
jgqleft bsdwf 
bt 


Here is a sample message from 'WJI' to 'CJL' (note the Italian date- 
time-group and the similarity to the message-format used by Italian 
diplo-stations !) 


nr. 06 

o 110825z giu 95 

gr364 

bt 

nwwvy ldonf ldon£ ldonf ldonf ldonf dwuiw gofth vtyit mejok 
Ca Pere Sens rest deleted ........... ) 

page 2 

glrcz arxzq zprzi epovd scsig hvnou bmulm nteix ansxx dkonh 
ere rest deleted ........... ) 


bgnlh psygp bzene kwpmz hmelb tkquo toahk vnmjq zbbzf£ fvnud 
evnmw unkad mmnhb nwwvy 
bt 


Here are the frequencies we have so far for the link 'CJL'/'WJIL': 


Frequency Channel nr. Callsign Mode 

14447 .00 (44) WIT ARQ-E-96/ITA-2 100 
14780 .50 CIL ARQ-E-96/ITA-2 100.87 
15721.50 CJL ARQ-E-96/ITA-2 100.87 
16217 .00 WIT ARQ-E-96/ITA-2 100 
16339.50 CIL ARQ-E-96/ITA-2 100.87 


17526.00 WII ARQ-E-96/ITA-2 100 


'M4W' / 'RK2': 
'M4W' is the "Israeli" side of the link. It is probably identical 
with station 'CJL' because: 


- It had crosstalk from a MOSSAD-number station on the carrier during 
the week that this was also experienced on 'CJL' transmissions. 


- It is sometimes heard transmitting in ARQ-E-96 with a 4 char. rep. 
cycle, when signing on at 08:20 UTC. 


- 'M4W' has been heard using 16339.5 kHz (accidentally). As soon as the 
operator realized his mistake, he switched over to the regular working 
frequency. 


- 'CJL' has been heard testing on the 'M4W' working frequency of 16129 kHz. 


DF-analysis on the station pinpointed it to the eastern part of the Medi- 
terranean area, somewhere in the area of Northern Israel or Lebanon. 


'M4W' uses Baudot telegraphy with 75 Baud, 1 stopbit per char. and the 
standard "Israeli shift" of 330-340 Hz. 


Here is a typical example of 'M4W' traffic: 

m4w m4w m4w = ryryryryryryryryryryryryryryryryryryryryryryryry 

m4w m4w m4ws ryryryryryryryryryryryryryryryryryryryryryryryry 

m4w m4w m4w=s ryryryryryryryr 

ok ok qsa 4 qsa 4 

i qru too qru qru 

pls qso qso qso 

ok ok ok tks tmxqs have a nice day 

bybybyby by by by 
'RK2' is located in or very near Moscow. It is probably an outlet also 
used for SOUD ("Brotherhood") transmissions. The station uses the standard 
eastern block 500 Hz shift and Baudot with 75 Baud and 1.5 stopbit. As in 
the SOUD-transmissions, the RY test-tapes are sent shifted as 4646...... 


Here is an example of an 'RK2' transmission: 
rk2 rk2 rk2 464646464646464646464646464646464646464646464646464646 
rk2 rk2 rk2 464646464646464646464646464646464646464646464646464646 
rk2 rk2 rk2 464646464646464646464646464646464646464646464646464646 


hr qsa fb qsa 4 
only ur wrk qrg 16128 pls next qso wrk qrg 16129 okej ? 


k ok ga pls 

i qru qru 

int qtc 

gb gb qru gb sk~— qso 

qso will wrk 

ok tks gb sk sk 

sk sk 

'M4W' and 'RK2' have a daily sked at 08:30 UTC, six days per week 

on 16129 and 16247 kHz. Messages are encrypted using 5 figure groups. 
As we haven't been able to catch the beginning of a message yet, we 
don't know what type of message headers are used. There is hardly any 
traffic on this link, the last message from the Israeli side to the 
Russian side was monitored in February 1995, yet still they have a 
daily sked. After a few minutes of operational chatter, the link is 
normally closed. 


Frequency Callsign Mode 

16129 , 00 M4W F1B-75 
16247 , 00 RK2 F1B-75 
19559 ,00 M4W F1B-75 


The question remains why an Israeli intelligence service would have 
a daily sked with its Russian counterpart. One of our fellow WUNers 
suggested a joint Russian-Israeli effort to help control Russian 
organized crime among the Russian immigrants entering Israel - an 
explanantion which seems to make sense. 


"RSB1', 'TFB', 'CAM', 'CIF9' and 'PTI2': 

These are a bunch of stations using a 3 channel FEC-A-192 VFT system. 
"RSB1' was very active but seems to have disappeared. 'CAM' and possibly 
'TFB' seem to be identical with 'CJL'. 'CAM' has been heard on 16339.5 
kHz at 07:52 in the morning and many times on 19243 kHz with crosstalk 
from the "MOSSAD-lady". Both 'CAM and 'TFB' have been heard running the 
same 100.87 Baud Baudot system used by 'CJL' and certain operator charac- 
teristics are very similar to the ones seen on the 'CJL' circuit. 


Traffic seen on these VFT-circuits consists of 5 LGs and a little 
chatter. The sign off is the typical "Israeli way" with “ar va ar va". 


It is yet unclear unclear who and where the other end of the link is, 
but it may be another multinational operation, as operator chatter is 
always in English. 


Here are a few text samples from the VFT-stations : 


de 


rsb1 rsb1 rsb1 
ryryryryryryryryryryryryryryryryryryryryryryryryryryryry 
1234567890 1234567890 1234567890 1234567890 


qtc qtc 
+ + + ccccccccccccccccceccccccceccccccccce 
277 221620 178 gr 


sahst nufms ~llgv witrce pbtug lovon rpwus yuaes diuwp jirgh 
wlrkm yzmyp mebsb taodb lywvv pyhpz vnfht rwitc twcfz vyzhu 
(as anaire basi dweraneriytey-8 rest deleted................ ) 

dlwzt bemzi xadok wtslb Innhm-wjhex tpwoi euauw trgxz wdurp 
ijqdb ybxeu edqvc kjvnn ntuza bqrey xyuky vubhd 


cam cam cam 
ryryryryryryryryryryryryryryryryryryryryryryryryryryry 
qru qru qru 

ar ar ar ar 


cam cam cam 
ryryryryryryryryryryryryryryryryryryryryryryryry 
qtc qtc 


494 091535 598 gr 

lhvno oyxut rksyp dgfet jodcc yexao enxgt gydpk iydbv boses 
ihrrj yeuon rzhwg omjqw wyngv nmogc mtxkb mldai rzjsy xqwiw 
Ce aeieies rest deleted..... ) 

page 2 

Coin’ rest deleted..... ) 


de 

cif9 cif9 cif9 
ryryryryryryryryryryryryryryryryryryryryryryryry 

1234567890 1234567890 1234567890 1234567890 

qru qru 
ryryryryryryryryryryryryryryryryryryryryryryryryryryryryryryry 
t£b tf£b tf£b t£b tf£b tf£b t£b tf£b tf£b tf£b 
ryryryryryryryryryryryryryryryryryryryryryryryryryryryryryryry 
tf£b tf£b tf£b tf£b tf£b tf£b tf£b tf£b tf£b tf£b 
ok ok ok ok 

tks tks 


zbz 4 qsa 4 qsa 4 zbz 4 
i qru qru qru int qtc qtc qtc qtc 


The stations can be heard on the following frequencies: 


Frequency Callsign 

12179 .80 TFB daily sked at 13:00 UTC 
12544 .80 RSB 1 (QRT ?) 

13404 .00 2??? 

14594 .00 2??? 

15852.30 PTI 2 

16099 .80 2??? 

16286.20 RSB 1 (QRT ?) 

16339 .50 CAM operator error ! 

19227 .10 CIF 9 daily sked at 09:00 UTC 
19243 .00 CAM daily sked at 08:00 UTC 
19406.20 2??? 

19911.00 PTI 2 

"KWO' 


This station was a daily guest on 18568.5 kHz and was last heard about 
11/2 years ago. The mode used was ARQ-E-96 with a rep. cycle of 8 
characters. I never managed to locate the other end of the link. The 
link was normally established at 12:00 UTC, although ‘KWO' was often on 
the air about 30 min. earlier with idle signals. From the operational 
messages seen on 'KWO' transmissions I would suggest that this was the 
Israeli side of the link. 


Here is a typical 'KWO' sample : 
ryryryryryryryryryryryryryryryryryryryryryryryryry 
the quick brown fox jumps over the lazy dog . 

de kwo 
ryryryryryryryryryryryryryryryryryryryryryryryryry 
the quick brown fox jumps over the lazy dog . 

de kwo 

ryryryryryryryryryryryryryryryryry rrxrr4r 

rrre 

rrrrrrrrrye 

i qsa 3 zbz3 

i qru qru qru 

int qtc qtc 

okokokokok tks pls rpt rpt 

tks tks by dear 

by by by by ar va 


I hope we have managed to draw your attention to this very interesting 


group of stations. If anybody can provide additional information on 
these or other similar stations, please feel free to post it to Ary. 
We are especially interested in any similar activity heard outside of 
Europe. 


Thanks for your efforts OM. Good stuff ! Well, that's all for now 
folks, it's time to sign off. Please send me your findings, loggings 
and news. I am looking for people who can tell me more about the 
navigation signals between 1600-3000 kHz. I'd like to cover them in a 
future edition of the newsletter. Write me for more info. Bye ! -Ary- 


Numbers & Oddities; the early days: February 1995-September 1995. 


Although the following article was not published in the N&O column but 

as a "Numbers" item in the ‘Digital Review' column, I just had to include 
it here because this is the rewritten and updated article about the FAPSI 
stations published in the WUN newsletter from June 1997. 


Russian diplo/intelligence [SOUD update 20-6-1997] 

We introduced you to the 'Brotherhood/SOUD' network via a special edition 
of the WUN newsletter in March 1995. Lots of updates have been published 
Since that date -mostly new schedules and stations- and numerous logs have 
popped up with various id's, such as BROTHERHOOD, SOUD, DoSC and lately 
also SVR and FAPSI. As SOUD doesn't exist anymore, I think it is time for 
a major update. For those of you who are unfamiliar with this network, I 
suggest that you catch up with the story by reading WUN newsletters vol.1 
nos.3 and 6 first. This update starts with a short who-is-who in Russian 
intelligence, followed by network specifics. 


As you probably all know, the KGB does not exist anymore but most of its 
former directorates are still alive and kicking in one form or another. 
While KGB (Committee of State Security) and its military counterpart GRU 
controlled nearly the complete intelligence system in the old days, a 
number of the new agencies come now under various ministries. A large part 
of the state security tasks are now handled by the FSB (formerly FSK and 
successor to the KGB). 


The Federal Agency for Government Communications and Information (FAPSTI), 
comprised of the former KGB 8th Chief Directorate and 16th Directorate, 
controls the country's communications networks and runs most electronic 
intelligence functions in Russia. According to a decree dated April 3, 


1995, FAPSI is empowered to monitor and register all electronic financial 
and securities transactions in Russia, and to monitor other electronic 
communications, including private Internet access. 


The SVR is the foreign intelligence service who was known as CSR till 
December 1991 and became part of the Ministry of Security (MB) under 

the new name 'SVR'. MB was in existence from 1991 to 1993 and was the 
initial successor to the KGB. In December 1993, SVR became an independent 
agency. The SVR has offices in Russian embassies, consulates and trade 
establishments throughout the world. 


The Russian Federal Security Service (FSB), responsible for internal 
Russian law and order AND counterintelligence activities. Originally 
the Federal Counterintelligence Service (FSK), the FSB was established 
in 1991 by president Boris Jeltsin as one of the successors to the KGB. 
The FSK was subordinate to the short-lived MB but became an independent 
agency in 1993 under the new name 'FSB'. 


The Russian Presidential Security Service (PSB), formerly the 9th Chief 
Directorate of the KGB, was established as an independent government 
agency in December 1993. In addition to providing security for Russian 

top officials and the guards for the Kremlin, the PSB supervises top- 
level government communications, operates and protects underground command 
centers, maintains the special underground train system that connects key 
government facilities in the Moscow area, and protects other strategic 
facilities, and executive aircraft and special trains. Those trains are 

an interesting item for us as well as the Russian Civil Railway Authority 
is also on SW. Leadership communications are carried out from the trains 
when a Soviet/Russian leader travels by train. The train was popular by 
president Brezhnev, who never flew except when he absolutely had to and 
then only outside the borders - and always used these trains. The trains 
are mostly used for their strategic rocket forces, a lot of which is rail- 
mounted. 


FAPSI is in fact the agency who is responsible for state communications 
and signals security. The agency was also one of the former KGB directo- 
rates, handling Federal communications and was responsible for the 
encryption of the government's messages; tasks they still carry out today. 
The agency operates a HF/satellite network, for both SIGINT purposes and 
transmission of government and intelligence traffic. Like the KGB in the 
old days, FAPSI works closely together with the GRU, Russia's military 
intelligence organization. They even share the SIGINT facilities around 
the world, lots of them located in embassies and consulates. 

In 1993 Russia closed a contract with Vietnam to ensure the continuing 
use of the SIGINT facilities in Cam Ranh Bay. In 1994 the Russians came 
to an agreement with the Latvian government, which gives them the right 
to use the SIGINT station in Skrunda till 1998. Russia's largest SIGINT 
facility abroad is the one in Lourdes (Cuba). Most of the RTTY and numbers 


transmissions heard in North America originate from various transmitter 
sites in Cuba. There are also SIGINT/tx facilities in Nicaragua. 


SOUD was an alliance of the intelligence agencies of the Communist block 
and its databases were accessible by all members of the former block. The 
members of SOUD were the Soviet Union, Bulgaria, Hungary, Poland, Czecho- 
slovakia, Mongolia, Cuba, East Germany and Vietnam. After the collaps of 
the block also SOUD's days were numbered. One of the main computer centres 
was in East Germany, and after East and West Germany reunited, the Stasi 
archives were soon in the hands of the BND, the West German intelligence 
agency. Nevertheless, it is believed that SOUD stayed in business for at 
least a couple of years but now as a Russian enterprise, possibly with the 
help of a few friendly nations like Roumania, Vietnam and Cuba. As most of 
the traffic was between diplomatic establishments, the assumption was made 
that a major part of the traffic was now diplo traffic (a large portion 
probably always was, even in the early days!) In the spring of 1996, I was 
informed that SOUD was definitely out of business but no-one could tell me 
exactly who was now in control of the network. Although I haven't got a 
written statement from Boris in Moscow, it is safe to assume that most of 
the traffic nowadays is diplo material and SVR traffic, transmitted by 
FAPSI. 


So, how shall we call the players on this net from now on? Although the 
major part of the traffic most probably originates from diplo sources and 
SVR, my personal vote goes to FAPSI as they are responsible for all comms 
from and to the embassies/consulates/MFA/SVR/FSB. GRU uses the same SIGINT 
facilities as FAPSI does, but seem to use mainly satellites for their 
communications. 

I think we shouldn't use the other reported names anymore. Someone asked 
me once if the 'Brotherhood' was the same as the American 'White Supremacy 
organization. The answer is a big -NO-. In the early days, when we didn't 
know who was using the net, we called them 'the Brotherhood', which was 
just our internal nickname for the net. Heck, I didn't even know there was 
another one :-) 

Another name we should not use anymore is of course SOUD. Finally we've 
got 'DoSC', the Department of State Communications, but isn't that the 
same as FAPSI? It is of course up to you how you want to call this net in 
your logs. From now on, I will refer to them as FAPSI though. When it 
comes to the numbersstations transmitting from Cuba, I suggest we'll call 
them 'SVR'. 


Right, that was a lot of intel talk. Because I received quite a lot of 
questions about the subject, I thought it would be a good thing to explain 
in a nutshell who KGB's successors are. Now then, I think it is wrong to 
put too much stress on the intelligence side of the network, so let's 
focus on the diplo traffic. 'Ok, but why switch to diplo and why is a new 
intelligence net like SOUD unlikely?', you may ask. Let's look at some of 
the facts so far. 


All links begin or end either in Cuba or near Moscow, while the other 
side of the links are mostly diplomatic and trade establishments like 
embassies and consulates. Part of the traffic will consist of intel/ 
military related nature but most of the traffic is -and probably always 
was- standard Russian embassy traffic! Since all messages basically look 
the same, it is however impossible to differentiate between diplo, intel 
or military related embassy traffic. 


Most of the calls from the early days are still around. (UDZ21, KUA, 
RPO, EWZ42, JUA, WOQL, etc....) meaning that we have still the same 
players on the net. 


Some that seem to have disappeared have changed to another mode 
(CW --> Baudot --> Crowd36) like FQX and KUA 


RCF no longer uses RCF as a call but is still around as a transmitter 
site, using a different call on each circuit. 


The way of operating is very similar to other Eastern European DIPLO 
networks (like the Bulgarians, Yugoslav, Czech and Slovak). 


All links end either in Cuba or in the vicinity of Moscow. 


QSF messages during important Russian holidays. If this were to be a 
multinational intel operation, they probably wouldn't have taken these 
holidays so seriously. Even the Israeli<->German link works 365 days per 
week, ignoring the Jewish sabbath and other even more important events. 


If you count all existing FAPSI links, you would probably end up having 
all the world collaborating with the Russian Intelligence to feed SOUD. 


Good operator discipline - fine, not much different to the Bulgarians 
and the YUG DIPLO operators. 


Rarely any chat traffic but when chat traffic, then always in Russian, 
using 3rd shift cyrillic. Wouldn't be so if it was an international 
operation. 


Always 500 Hz shift! In other multinational operations, the operators 
never adjust the shift to hide their identity! 

Moscow RK2 500QHz <--> Tel Aviv M4W 340 Hz 

Warsaw SNG202 500Hz <--> Bucharest YPM69 400 Hz 

Rome WJI 850 Hz <--> Tel Aviv 340 Hz 

Germany 190 Hz <--> Tel Aviv 340 Hz 


Have you ever noticed a station belonging to the FAPSI net using a 
shift other than 500 Hz ? 


o Occasionally we caught long Russian chats, mentioning the diplomatic 
pouch and lots of personal stuff. Personal stuff like this would never 
be allowed on a net used purely for intel purposes. 


o If our network were to be intel only..... then where are the Russian 
diplos? Every Russian embassy has HF antennae but not every one seems 
to have SAT-equipment.... 


o After the collapse of the Warsaw Pact an international intel net as 
SOUD should have reduced traffic, but it didn't! Links should have 
vanished, but they didn't, in fact we have as many as in the early days, 
if not more. 


o Circular traffic (KUL, VKX, RAU, ... traffic) can be noted on YUG, BUL, 
CZE, SVK diplo nets in a very similar manner. The only difference is, 
that our bunch encrypts all the time! 


o A typical DIPLO characteristic is the use of different modes, depending 
on the level of flexibility and security you want on a specific link. 
What modes can be noticed on FAPSI transmitter sites? Standard Baudot 
F1B-75/100/200 + CROWD36 (on- and offline encrypted) + IRA-ARQ on the 
Moscow - Cuba link and to some extent 12-channel PSK traffic alternating 
with online encrypted Crowd36. It seems that links to the very important 
embassies are being established using online encrypted Crowd36. 


This wide variety of modes is not unusual and can be seen on many other 
diplo nets as well. 


Yugoslavia: FEC-A-144 + F1B-75 
Czech Rep.: IRA-ARQ + F1B-100 + High speed QPSK 


Hungary : HNG-FEC + DUP-ARQ 

Norway : SITOR-A + TWINPLEX + DUP-ARQ-2 

Turkey : RS-ARQ-228.65/240.81 + FEC-A-144 

India : VFT:FEC-A-96 + F1B-50 + PSK (tests?) 

Italy : ARQ-E-96 + SITOR-A + RS-ARQ + 1200bd PSK or FSK 
Germany : ARQ-E-96 + RS-ARQ-228.65/240.81/ + 2400bps PSK 
France : FEC-A-192/384 + TT2300B 

etc. etc. etc. 


*k*x NETWORK SPECIFICS - MODES, FREQS, LINK ID's AND CALLSIGNS xxx 


Crowd36 40/10 bd 32 tones (+ selcall system) 
12-channel PSK 

IRA-ARQ 110.2 bd / 500 Hz shift 

IRA-ARQ 300.5 bd / 500 Hz shift 


Baudot 50 bd / 500 Hz shift 
Baudot 75 bd / 500 Hz shift 
Baudot 100 bd / 500 Hz shift 
Baudot 200 bd / 500 Hz shift 
Mazielka 6-tone selcall system 


4-letter combinations have been noted on the Crowd36 links. These 
sequencies most probably are used to trigger the computers on the 
receiving side. The following sequencies were copied: VDAA, VDAG, 
VDBA, VDBE, VDCB, VDCE, VDCF, VDEA, VDFB, VDGB. So far they have 
been noted when... 

a) changing from 40Bd to 10Bd 

b) changing from 10Bd to 40Bd 

c) shutting down the link 

d) they are often sent in the middle of an ongoing transmission 


Numbers transmissions and ‘our' network. 

One of the monitors sent me his very interesting findings as you can 
read hereafter. 14747 and 14787 kHz seem to be quit interesting places. 
Here are the relevant quotes from the reports: 


Sai toonece ats the testing that has been taking place the least several months 

on 14747. The use of this frequency is strange. It's almost like it's 
programed as a test freq. I have seen tests of virtually every mode and 
service on this freq in the last few months. 

This morning at 1550Z (12-12-'96) I tuned to this freq and heard the mark 
tone but I though I heard voice on it. I switched to AM mode and, to my 
surprise, there was a mechanical male voice counting in English like so: 
one, one, one, one, one, two, two, two, two, two, three, three, three, 
three, three four, four, four, four, four on up through nine. Then instead 
of zero, a word that very distinctly sounded like "VEEL" pronounced like 
the english word "veal" (as in the meat) and rhyming with the word "reel". 
There was much clicking, buzzing and occassional distortion - like the 
operator was adjusting the audio output of the numbers generator. There 
were frequent long pauses interspersed with number combinations like one, 
one, or four, five, and frequently "veel, one; veel one" After a while it 
settled down to repeated counts of "one, two, three, one, two three" This 
went on for another 5 minutes or so. And then came Spanish numbers. 

Pretty much the same routine, but now a male in Spanish: "uno, dos, tres, 
quatro" and so on up to "cero." Sometimes just long counts of "uno, uno, 
uno, uno, uno" Now interestingly enough, the Spanish numbers stop and I 
hear a female voice repeating in English "five, two, nine; five two nine; 
five two nine. Then a series of clicks, clacks and a a long period (maybe 
20 minutes) of what sounds like heavy 60 Hz hum. Then back to male English 
repeating "one, two, three; one, two, three." And underneath the male 
voice I hear a female voice repeating the "five, two, nine" routine again 
and what sounds like audio feedback. The station abruptly goes down at 


1659Z. Maybe they can't afford a dummy load, or didn't know they were 
actually on the air or just didn't care, but these guys were certainly 
adjusting their numbers transmissions' audio." 


Another example: on Feb.7, 1997 a carrier came up on 14787 around 1515Z. 
Steady carrier for about 5 min. Then FSK vvvvv's. Then 75bd 4646464646's. 
Then 100bd 4646464's followed by a carrier. The 300.05 bd data (I assume 
was IRA-ARQ). Then about 30 minutes of adjusting voice generation equip- 
ment again in both Spanish and English. Then on to CW "989 20" repeated 
then on to 20 group text with lots of 12345's in it (obviously test tfc). 
Then turns keyer speed up to about 45 WPM and more test CW. Finishes with 
989 TTTTT (real typical ex-KGB style, right?). Finally goes down at 1807Z. 


Several times recently, on 14787 after the carrier was on for a while, I 
heard some "noise" slightly off freq. On tuning exactly 1.75 KHz higher 

I found a digital signal with following characteristics: 292.75bd 185Hz 
shift ACF=10. The strange thing is this signal is directly "coupled" with 
the carrier on 14787. When the carrier on 14787 went down so did the 
digital 1.75 kHz higher. I don't think it is a mixing product. It's to 
strong (same signal strength as the carrier below) and very pure. I have 
heard this on three different occasions now, and always only after the 
Carrier comes up on 14787 for a few minutes first. Almost like the carrier 
is a "pilot" signal............. 


Frequencies / call signs / link id's 

The following list contains actual monitoring results of the past two 
years. First however a list of call signs / links that haven't been 
reported during the past few years. They may pop up one of these days; 
you'll never know........ 


80031, ACD, BLA, BNV, BXL, CMU, DMA, DPL, DSG, EWZ 40, FJN, FRU, GLK, 
KDN, LSG, NDO, NMZ, OBX, OTD, OWR, PSN, PTF, RCF, RCX 81, RFA, RKG, 
RKM, RMM, RQO, RSS, RXX, RZJ, SCJ, TRP, UDZ 27, WKL, WNK 


Most transmissions come from either Moscow or Cuba. Only a few other 
locations are known. 


Note: station RCF (Moscow) still exists but uses nowadays other call 
signs; a different one on each Link. 


Managua = WFO (link with MIG - Cuba) 

Cuba = MIG (link with WFO - Managua) 

Cuba = COY 851 (link with YFC) 

Mexico City = GMN (not confirmed) 

Baghdad = KUA (not confirmed; link with KKK - Moscow) 
London = UXW (not confirmed; link with RLX - Moscow) 


Moscow = RCF (now inactive) 


Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 


= VNB 
= RVV 
= WCD 
= KKK 
= RLX 
= RGA 
= RBP 
= RK2 
= JSC 


(link with WQL) 
(link with DZR) 
(link with LKF) 


(link with UXW - London) 
(link with KUA - Baghdad) 


(link with BFR) 
71 (link with RVC 


(link with M4W - Mossad) 
(link with POU -not 100% certain-) 


47) 


Other transmissions from Moscow were to CAZ, DKR, EWZ 42, FQX, GOD, 
JUA, KRN, KUL, NOB, NQX, RAD, RAU, RJA, RKD, RPO, RSZ, UDZ 21, UGO, 
VKX, VTX; all unid locations. 


Note: JSC and POU were both copied on link 00190. It is however not 
clear whether POU replaced JSC or that JSC and POU are both ends of 


this link. 


Other transmissions from Cuba were to BAR, BPA, HZW, JMS, KAC, NDO, 
WNY, YBU; all unid locations. 


PSN, SPK, 


Frequency 


Station 


Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Unid 

Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Unid 

Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Unid 

Unid 

Unid 


ITU Callsign To 


VNB 


VNB 


VNB 


RVV 
RVV 


WQL 


DZR 
DZR 


80061 


70026 
00149 
00149 
90223 
90039 


7718. 
7730. 
7810. 
7821. 
7823. 
7823. 
7823. 
7826. 
7887. 
7920. 
8008. 
8023. 
8032. 
8059. 
8062. 
8067. 
8089. 
8091. 
8110. 
8117. 
8165. 
8165. 
8169. 
8179. 
9031. 
9075. 
9088. 
9118. 
.00 
9132. 
9162. 
9169. 
.00 

9213. 

9215. 

9237. 

9244. 

9274. 

9288. 
10125. 
10135. 
10140. 
10156. 
10176. 
10178. 
10183. 
10196. 
10202. 


9127 


9172 


00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 


00 
00 
00 


00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 


Moscow 
Moscow 
Moscow 
Moscow 
Cuba Relay 
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00052 


00030 


00030 


.20 
.55 
.38 
.21 
.00 
.00 
. 00 
.07 
.22 
.40 
.05 
.10 
. 00 
.10 
. 00 
.58 
.35 
.53 
. 00 
.44 
.35 
£33 
. 00 
. 00 
.44 
31 
.57 
.28 
.34 
. 00 
.00 
.26 
.07 
. 30 
.10 
.12 
.12 
.12 
.10 
.10 
.15 
. 00 
. 50 
.44 
. 00 
. 50 
.50 
.48 


15707. 
15708. 
15710. 
15712. 
15722. 
15724. 
15733. 
15735. 
15735. 
15771. 
15826. 
15826. 
15836. 
15836. 
15845. 
15845. 
15879. 
15880. 
15889. 
16008. 
16018. 
16032. 
16054. 
16054. 
16064. 
16066. 
16081. 
16108. 
16108. 
16108. 
16116. 
16119. 
16120. 
16121. 
16129. 
16145. 
16153. 
16153. 
16154. 
16154. 
16155. 
.00 


16165 


16168. 
16214. 
16214. 
16218. 
16225. 
16226. 


00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
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00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
88 
00 


00 
00 
00 
00 
00 
00 


Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Unid 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Cuba Relay 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Unid 
Unid 
Unid 
Mossad 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Cuba Relay 
Cuba Relay 
Cuba Relay 


RUS 
RUS 
RUS 
RUS 
RUS 
RUS 
RUS 
RUS 
RUS 
RUS 
RUS 
2??? 
RUS 
RUS 
RUS 
RUS 
RUS 
RUS 
CUB 
RUS 
RUS 
RUS 
RUS 
RUS 
RUS 
RUS 
RUS 
RUS 
RUS 
RUS 
RUS 
RUS 
2??? 
RUS 
ISR 
RUS 
RUS 
RUS 
RUS 
RUS 
RUS 
RUS 
RUS 
RUS 
RUS 
CUB 
CUB 
CUB 


RGA 
KKK 


RGA 


RLX 


KKK 
KKK 
KKK 


M4W 


BFR 
KUA 


BFR 
RPO 


FQX 
FQX 
RSZ 
UXW 


RAD 


SPK 


KUA 
KUA 
KUA 
VKX 


UDZ 
UDZ 


RK2 
DKR 


DKR 


FQX 


HZW 
BPA 
YBU 


21 
21 


60047 
00030 
30022 


00030 
80038 
30088 
60003 
60003 
00099 
40034 


07039 


00198 


00168 
10163 
10163 
30088 
30022 
30022 
30022 
11230 
00166 


20054 
20054 
60047 


40078 


70060 


70060 


30044 
60003 
60015 
00117 
00116 
00148 


rR 


rR 
FOANWADTANUDOD0GON 


.00 
. 30 
.58 
.50 
.05 
.29 
.05 
. 30 
.00 
.20 
.45 
. 30 
.53 
.05 
. 00 
.00 
.32 
.50 
. 00 
.20 
+33 
.55 
.10 
.46 
.53 
.43 
.33 
.54 
. 50 
.06 
.50 
.00 
.40 
. 00 
. 30 
.00 
35 
.00 
.45 
. 00 
.05 
.00 
.20 
.54 
.25 
. 00 
.45 
.00 


16232. 
16242. 
16242. 
16242. 
16244. 
16245. 
16247. 
16252. 
16253. 
16254. 
16255. 
16257. 
16273. 
16277. 
16277. 
16277. 
16285. 
16285. 
16294. 
16305. 
16312. 
16320. 
16324. 
16332. 
16340. 
16340. 
16342. 
16344. 
16446. 
16446. 
16841. 
17402. 
.00 
17422. 
17465. 
17465. 
17474. 
17533. 
18092. 
18092. 
18183. 
18185. 
18206. 
18225. 
18245. 
18247. 
18250. 
18251. 


17421 


00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
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00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
00 
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00 
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00 
00 
00 
00 
00 
00 
00 
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Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Unid 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Unid 
Moscow 
Moscow 
Unid 
Unid 
Unid 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Unid 
Cuba Relay 
Cuba Relay 
Moscow 
Moscow 
Moscow 
Moscow 
Moscow 
Unid 
Moscow 
Moscow 
Moscow 
Moscow 
Cuba Relay 
Moscow 
Moscow 
Moscow 
Unid 
Moscow 
Moscow 


RUS 
RUS 
RUS 
RUS 
RUS 
RUS 
RUS 
RUS 
RUS 
2??? 
RUS 
RUS 
RUS 
RUS 
RUS 
RUS 
2??? 
RUS 
RUS 
2??? 
RUS 
2??? 
RUS 
RUS 
RUS 
RUS 
RUS 
RUS 
2??? 
CUB 
CUB 
RUS 
RUS 
RUS 
RUS 
RUS 
2??? 
RUS 
RUS 
RUS 
RUS 
CUB 
RUS 
RUS 
RUS 
2??? 
RUS 
RUS 


RVV 


RK2 
RVV 


KKK 


KKK 
KKK 


KKK 


FOX 
RSZ 
DZR 


RJA 
VKX 
M4W 
DZR 
RJA 


POU 


RJA 
VTX 


RSZ 


UGO 


KUA 


KUA 
KUA 


KUA 
KRN 
WNY 
JMS 


JUA 
RSZ 
RSZ 
FOX 
FOX 
GMN 


JUA 
VKX 


JUA 


60003 
00099 
00149 


90051 
00166 


00149 
90051 
20076 
00190 
90051 
00098 
60069 


80050 
00177 
00099 
00029 
50079 


40078 
30022 
10042 
30022 
30022 
10042 
30022 
00178 
00139 
00127 
10042 
50035 
60047 
00099 
00099 
10163 
30088 
60003 
60003 


00119 
50035 
00166 
60047 
10079 
50035 
00063 


rR 


rR 


rR 
AN WADRFPArFPAWAHON OO 


lee) 


18332.00 Moscow RUS 10042 9.14 


18338.88 Moscow RUS 00096 10.35 
18345.00 Moscow RUS 2.00 
18346.88 Moscow RUS 00096 10.30 
18420.00 Unid 2??? UGO 50079 11.30 
18424.00 Moscow RUS 10042 14.05 
18440.00 Moscow RUS 11.40 
18575.00 Moscow RUS 11.18 
18580.00 Moscow RUS 10.45 
18585.00 Moscow RUS CAZ 50002 10.10 
18610.00 Moscow RUS RPO 80038 10.35 
18695.00 Moscow RUS 9.31 
18752.00 Moscow RUS 60069 7.31 
18803.00 Cuba Relay CUB YBU 00148 14.10 
18835.00 Moscow RUS RGA BFR 00030 14.35 
18844.00 Cuba Relay CUB BPA 00116 16.25 
18965.00 Cuba Relay CUB SPK 00168 16.00 
19088.00 Cuba Relay CUB WNY 00139 18.00 
19354.00 Moscow RUS RPO 80038 8.14 
19412.00 Moscow RUS CAZ 50002 10.05 
19559.00 Mossad ISR M4W RK2 8.30 
20042.00 Moscow RUS FQX 60003 8.50 
20140.00 Cuba Relay CUB YBU 00148 22.00 
20340.00 Moscow RUS 10042 11.10 
20412.00 Moscow RUS 10.00 
20443 .00 Unid 2??? 8.38 
20690.00 Moscow RUS RPO 80038 11.47 
20731.00 Cuba Relay CUB GMN 00119 17.45 
21865.00 Cuba Relay CUB BPA 00116 16.00 


Russian Civil Railway Authority 
Mode: '81-81' 40.5bd / 500 Hz 
Freqs: 12184 (logged between 08.30-09.30 UTC), 
14985, 16315 kHz (both logged between 07.30-08.30 UTC) 


Abbreviations 


SOUD - Sisteme Objedinennowo Utschotja Dannych o protiwnike 
[System of mutual gathering of data about the enemy] 


MB - Ministertsvo Bezopasnosti (Ministry of Security) 
KGB - Komitet Gosudarstvennaya Bezopasnosti [Committee of State Security] 
FSB - Federalnaya Sluzhba Bezopasnosti [Federal Security Service] 


(Formerly known as 'FSK' Federalnaya Sluzhba Kontrazvedky 
-the Federal Counterintelligence Service-) 


GRU - Glavnoye Razvedyvatelnoye Upravlenie [Military Intelligence] 
SVR - Sluzhba Vneshnoi Razvedky [Foreign Intelligence Service] 


FAPSI - Federalnoe Agentstvo Pravitelstvennoy svyazi i informatsii 
[Federal Agency for Government Communications and Information] 


CSR - Centralnaya Sluzhbza Razvedky [Central Intelligence Bureau] 
PSB - Prezidentskaya Sluzhba Bezopasnosti [Presidential Security Service] 
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The 'Numbers & Oddities' column a.k.a. ‘Spooks Newsletter’ comes to you 
courtesy of the Worldwide Utility News club. This newsletter may NOT be 
utilized, partly or wholly, in any other media format without the written 
permission of the editor (ary@luna.nl). Any breach of this may result in 
action under international copyright legislation. 


To become a WUN member, send e-mail to the WUN listserver at: 
majordomo@qth.net and in the BODY of the message type: "subscribe wun" 
(without the quotation marks). 


Check out the WUN web site at: http://www.wunclub.com 
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